Report: House Committee on Small Business Investigation into Fraud in the COVID Lending Programs

Summary

This report presents the findings of the House Committee on Small Business's investigation into fraud in the COVID Lending Programs. It states that the investigation began on March 15, 2023, when Chairman Roger Williams sent letters about the SBA's decision to end active COVID EIDL and PPP loans valued $100,000 or less. The report says it is likely that $200 billion from the programs was disbursed to fraudulent recipients, with $136 billion in COVID EIDL and $64 billion in PPP fraudulent loans. The report's listed conclusions include that Congress prioritized rapid dispersal of funds over fraud risk and that self-certification should be avoided in future programs. The table of contents lists sections on fraud within COVID EIDL, the PPP, and the RRF and SVOG programs, plus recommendations.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

About this report. The House Committee on Small Business report states that "it is likely that $200 billion from the COVID Lending Programs were disbursed to fraudulent recipients," citing SBA Inspector General Report 23-09. That OIG report estimated that SBA disbursed over $200 billion in potentially fraudulent loans and advances, which is not the same as likely or proven fraud. The report also cites SBA's own estimate of $36 billion in fraud across all programs.

Document type: Report
Date: 2024-11-01

Cite this document

“Report: House Committee on Small Business Investigation into Fraud in the COVID Lending Programs.” Original at smallbusiness.house.gov, dated 2024-11-01. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2024-11-01-d-treasury-and-credit-bureau-reporting-32/, SHA-256 ee791b6d97894b207aedf1b274401c5522bf0279512754d284932005b7e16f68.

Full text

1
Table of Contents
I. Executive Summary...................................................................................................... 4
II. Introduction. ................................................................................................................ 5
1. Background............................................................................................................... 5
2. Legislation. ............................................................................................................... 5
3. COVID Lending and Grant Programs. ..................................................................... 6
A. COVID-19 EIDL and Advances............................................................................ 6
B. Paycheck Protection Program.............................................................................. 9
C. Restaurant Revitalization Fund............................................................................ 9
D. Shuttered Venue operators grant........................................................................ 10
III. Fraud Within the COVID EIDL Program. ........................................................... 12
1. Introduction............................................................................................................. 12
2. Self-certification...................................................................................................... 13
3. Programmatic Structure. ......................................................................................... 14
A. Incentive Structure.............................................................................................. 15
B. Lump Sum payments. .......................................................................................... 17
C. Additional Documentation Requirements........................................................... 19
4. Control Environment. ............................................................................................. 20
5. The SBA’s Capacity................................................................................................ 23
A. Contractors......................................................................................................... 24
6. Data management. .................................................................................................. 25
7. The PPP Program and Anti-Industry Sentiment. .................................................... 27
8. COVID EIDL Conclusions..................................................................................... 27
IV. Fraud Within the PPP.............................................................................................. 28
1. Introduction............................................................................................................. 28
2. Programmatic Structure. ......................................................................................... 28
A. Lump Sum Payments........................................................................................... 28
B. Moral Hazard. .................................................................................................... 29
3. Control Environment. ............................................................................................. 30
4. Management Challenges......................................................................................... 30
A. Data. ................................................................................................................... 31

2
B. Lender Guidance. ............................................................................................... 31
C. Partner Oversight............................................................................................... 32
D. Treasury and Credit Bureau Reporting. ............................................................. 32
5. The PPP Program Conclusion................................................................................. 33
V. Fraud Within the RRF and the SVOG Programs................................................... 34
1. Fraud in the RRF Program...................................................................................... 34
2. Fraud in the SVOG Program. ................................................................................. 34
3. RRF and SVOG Conclusions. ................................................................................ 35
VI. Recommendations. ................................................................................................... 37
VII. Conclusion............................................................................................................... 39
IX. Acknowledgements................................................................................................... 40

3
I. Executive Summary
This report discusses the findings of the United States House Committee on Small Business’s (the Committee)
investigation into fraud in the COVID Lending Programs established in response to the COVID-19 Pandemic.1 The
investigation into the Small Business Administration’s (SBA) handling of these programs began on March 15, 2023, when
Chairman Roger Williams sent letters requesting information regarding the SBA’s decision to end active COVID EIDL
and PPP loans valued $100,000 or less.2 Through the Committee’s investigation, which was supplemented by the various
findings of Inspectors General and Government Accountability Office (GAO), it has become clear that the COVID Lending
Programs were replete with fraud, the mismanagement of which likely cost taxpayers hundreds of billions of dollars.

In creating the COVID Lending Programs, Congress understood that the relief funds needed to be issued quickly to
help businesses cope with the economic strain of the pandemic. The rush to get pandemic relief funding out quickly resulted
in shortcuts being taken to deliver aid quickly to small businesses in hopes of recouping improper disbursements on the back
end. Despite being aware of many of these fraud risks from the outset, the SBA made numerous decisions that decreased the
likelihood that the government would successfully be able to detect and recover fraudulently obtained loans.

In total, it is likely that $200 billion from the COVID Lending Programs were disbursed to fraudulent recipients.3
This is largely made up of the COVID EIDL and PPP portfolios, which represented $136 billion and $64 billion in fraudulent
loans respectively.4 This report will focus exclusively on the issues within the COVID Lending Programs related to fraud
risk, and does not assess other issues within the COVID Lending Programs, such as the program’s cost-effectiveness or the
targeting of benefits. 5

Over the course of this investigation, the Committee wrote six letters to the SBA and other agencies, held one
transcribed interview, issued its first documents subpoena in over a decade, and reviewed over 4,000 pages of documents
and reports. Upon reviewing the data, testimony, and documents, the Committee has come to the following conclusions:

• Congress too strongly prioritized the rapid dispersal of funds without adequate appreciation for the fraud
risk presented by these programs.
• The SBA, at the time of the programs’ creation, lacked the experience, resources, and capacity to implement
the legislative requirements without increasing fraud risks.
• The Biden-Harris Administration’s SBA leadership was overly preoccupied with optics, resulting in it
taking actions that increased fraud risk and wasted taxpayer dollars.
• A disproportionate focus on the PPP Program led to issues within the COVID EIDL portfolio going
underappreciated.
• In future programs, self-certification should be avoided, and fraud risk controls should not be relaxed in
favor of the rapid dispersal of funds.
• Regardless of whether basic fraud risk controls are relaxed, lawmakers should assess whether lump sum
or single advance payments are reasonable and should consider alternative payment structures when
appropriate.
• When loans are issued with minimal eligibility criteria, borrowers should be required to satisfy subsequent
criteria, such as providing additional documentation, throughout the life of their loan in order to receive
their maximal benefit; in the case of the PPP program, this was loan forgiveness.

1
The PPP Program, COVID EIDL Program, SVOG Program, and RRF Programs will be referred to collectively as the “COVID Lend-
ing Programs.” Further, while technically redundant, the Paycheck Protection Program and the COVID-19 Economic Injury Disaster
Loan Program will be referred to as the “the PPP Program” and “COVID EIDL loans” throughout this report, for ease of reading and
consistency.
2
Letter from Roger Williams, Chairman, H. Comm. on Small Bus., to Isabella Casillas Guzman, Administrator, U.S. Small Bus.
Admin. (Mar. 15, 2023).
3
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 8 (Jun.
27, 2023).
4
Id.
5
Given that the RRF and SVOG programs were smaller and faced additional issues outside of fraud, this staff report will direct more
attention to the causes of fraud within the PPP Program and COVID EIDL programs.

4
II. Introduction
1. Background
In December 2019, the first reports of a new upper respiratory infection that became known as COVID-19 emerged.6
By March 13, 2020, the United States declared a nationwide emergency and began to enter a period described as “the
shutdown,” where individuals were strongly encouraged to stay home, and all businesses deemed “nonessential” by the
government were forced to close.7 The shutdown ushered in an economic catastrophe which brought about inflation and
supply chain issues that persist into 2024. In response to the threats posed by COVID-19, Congress passed the Coronavirus
Aid, Relief, and Economic Security Act (CARES Act) and other legislation aimed at helping Americans and their businesses
stay afloat while they were forced to close. These laws created and tasked the SBA with managing the PPP Program, the
COVID EIDL program, the Restaurant Revitalization Fund (RRF), and the Shuttered Venue Operators Grants (SVOG)
(collectively, the COVID Lending Programs/Portfolio). In total, the COVID Lending Programs issued $1.2 trillion in aid to
businesses, and eligible nonprofits.8

Prior to being tasked with administering the COVID Lending Programs, the SBA managed a portfolio worth $143
billion.9 The scale of the COVID Lending Portfolio increased the SBA’s size as a lender to briefly rival Truist, the 8th largest
bank in the United States.10 Before the start of the COVID Lending Programs, the largest program the SBA administered
was the 7(a) program, which typically issued between $20 and $25 billion in loans per year.11

2. Legislation
In 2020, during the 116th Congress, legislators passed five bipartisan bills aimed at assisting Americans during
the shutdown and pandemic period. The first piece of legislation passed during the 116th Congress was the Coronavirus
Preparedness and Response Supplemental Appropriations Act, which provided $7.8 billion in aid funds and laid the
groundwork for the creation of the COVID EIDL program.12 Congress then passed the Coronavirus Aid, Relief, and Economic
Security Act, (CARES Act) which created the PPP Program, expanded the COVID EIDL Program, and created the COVID
EIDL Targeted Advance.13 This was followed by the Paycheck Protection Program and Health Care Enhancement Act,
which increased funding to the CARES Act programs.14 In December 2020, Congress passed the Coronavirus Response and
Relief Supplemental Appropriations Act (also known as, the Consolidated Appropriations Act of 2021).15 This bill added
funding to the SBA’s programs and refined the criteria by which the SBA is permitted to assess loan eligibility.

In the 117th Congress, during which the House and Senate had Democratic majorities, Congress passed the partisan
American Rescue Plan (ARP). This created the RRF program and provided more funds to assist Americans during the
pandemic, despite the fact that the pandemic and shutdown were in their final phases.16 The ARP also included a cavalcade
of Democrat policy priorities.17 Notwithstanding the ethical concerns of coopting an aid package to serve partisan ends,
these bills together created the COVID Lending Programs the SBA managed. In total, Congress made over $5.5 trillion in
6
CDC Museum COVID-19 Timeline, U.S. Ctr. For Disease Control and Prevention (Last visited Aug 12, 2024).
7
Erin Schumaker, Here are the states that have shut down nonessential businesses, ABC News (Apr. 3, 2020).
8
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun.
27, 2023).
9
Loan Program Performance, U.S. Small Bus. Admin. (Jul. 23, 2024)(Table 1 – Unpaid Principal Balance by Program).
10
Williams Adley report for the U.S. Small Bus. Admin., CARES Act BPA – Task Order 4, EIDL-COVID Portfolio Servicing Analysis,
TASK 2: ANALYSIS OF ALTERNATIVES REPORT (Including updates to cash flow assumptions), 5 (Sep. 29, 2021).
11
Loan Program Performance, U.S. Small Bus. Admin. (Jul. 23, 2024)(Table 1 – Unpaid Principal Balance by Program, Table 2 –
Gross Approval Amount by program).
12
Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020, H.R. 6074, 116th Cong. (2020).
13
CARES Act, H.R.748, 116th Cong. (2020).
14
Paycheck Protection Program and Health Care Enhancement Act, H.R. 266, 116th Cong. (2020).
15
Consolidated Appropriations Act, 2021, H.R. 133, 116th Cong. (2020).
16
The Six Laws that Funded Pandemic Relief Programs, Pandemic Response Accountability Committee (Nov. 6, 2024); American
Rescue Plan Act of 2021, H.R. 1319, 117th Cong. (2021) (Which apportioned less than ten percent of funds to public health mea-
sures).
17
Savannah Berhmann, Biden’s relief bill isn’t getting bipartisan support like previous stimulus bills. What do Republicans dislike so
much?, USA Today (Mar. 5, 2021).

5
aid available during the pandemic, of which $1.2 trillion went to the SBA for its lending and grant programs. While having
similar purposes, the specifics of the COVID lending programs varied.

3. COVID Lending and Grant Programs
The SBA was responsible for starting and managing over $1.2 trillion worth of lending programs that were created
and modified through these various pieces of legislation. Within 21 days of passing the CARES Act, the SBA issued more
loans than it had issued in the previous 14 years combined.18 This required the SBA to overcome numerous technical and
practical challenges in addition to other issues.

The volume of loans the SBA issued was substantial. SBA’s Portfolio of COVID Lending Programs loans and
grants would make it one of the largest financial institutions in the United States. The COVID EIDL, PPP, SVOG, and
RRF programs all intended to assist Americans during the pandemic, but each program had unique features, criteria, and
beneficiaries.

A. COVID-19 EIDL and Advances

COVID EIDL Loans and Advances were distributed to businesses to keep them from failing and to help cope with
the COVID-induced loss of revenue. COVID EIDL loans were part of a direct lending program managed by the SBA,
modeled after the SBA’s existing 7(b) loan program.19 COVID EIDL loans were issued to borrowers as traditional 30-year
loans with between 2.75 and 3.75 percent interest rates.20 While the SBA was responsible for issuing these loans, it relied
on a contractor for processing and underwriting.21 While the SBA used contractors, it was still the chief entity responsible
for servicing these loans.22 In order to manage the loan volume of the COVID EIDL program, the SBA had to massively
scale up its operations and make substantial infrastructural investments, including acquiring a new building to house the
servicing operation, and reorganizing the SBA to have COVID EIDL moved from the SBA’s Office of Disaster Assistance
to the SBA’s Office of Capital Access.23

Both Congress and the SBA expected COVID EIDL loans to be paid back by borrowers, though there was some
confusion among the American populace, however, as the simultaneous PPP Program loans did not have to be repaid if
certain qualifications were met. The COVID EIDL program was initially capped at $150,000 per loan, but subsequent
legislation increased the total maximum amount available to $2 million, though SBA could reduce this cap.24 Below is
breakdown of the differences between COVID EIDL and the traditional EIDL program:

18
Jovita Carranza, PPP Processed More than 14 Years Worth Of Loans In Less Than 14 Days, USA Today (Apr. 20, 2020).
19
Bruce R. Lindsay, et al., Cong. Research Serv., R47509, SBA COVID-EIDL Financial Relief: Policy Options and Consider-
ations, 3 (Apr. 18, 2023).
20
Id. at 4.
21
Hereinafter the SBA and its contractor responsible for accepting applications and underwriting will be referred to as just “the SBA,”
when discussing action’s these entities undertook together.
22
Disaster Loan Servicing Centers: Site Overviews, U.S. Small Bus. Admin. (Jan. 25, 2024).
23
FI Consulting report for the U.S. Small Bus. Admin., Paycheck Protection Program Recovery Cost Benefit Analysis, 5 (Dec. 8,
2021); Transcribed Interview with Jihoon Kim, Director, Small Bus. Admin, Off. of Fin. Prog. Ops (Jun. 7, 2024).
24
William B. Shear, Gov.Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program:AdditionalActions Needed
to Improve Communication with Applicants and Address Fraud Risks, 35 (Jul. 2021).

6
Table 1. CARES Act Changes to COVID Injury Loan

To ensure businesses received aid quickly, the CARES Act forced the SBA to issue loans based only on credit
scores.26 The personal guaranteed threshold for these loans was $200,000 and the SBA was required to waive its standard
requirement to be a lender of last resort. Borrowers were permitted to self-certify their eligibility for these loans for the
majority of this program.27 Prior to the legislative fixes to this program in the Consolidated Appropriations Act of 2021, the
COVID EIDL loans and advances had the following criteria:

25
CARES Act, H.R.748, 116th Cong. (2020),
26
William B. Shear, Gov.Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program:AdditionalActions Needed
to Improve Communication with Applicants and Address Fraud Risks, 12 (Jul. 2021).
27
William B. Shear, Gov.Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program:AdditionalActions Needed
to Improve Communication with Applicants and Address Fraud Risks, 34 (Jul. 2021).

7
Table 2. Economic Injury Disaster Loan Program Eligibility Criteria and Validation

In attempting to meet Congress’s aims, the SBA also removed its standard requirement of conducting a second
review of approved loan applications and set high production goals. In meeting those goals, the SBA approved loans in large
batches and ignored system flags.29

Upon realizing the risks posed by self-certification, Congress allowed the SBA to require applicants to provide tax
documentation in support of their loan applications.30 Additionally, since much of the fraud in these programs was expected
to be identified on the back end, the SBA began slowly, but inconsistently, improving its control environment throughout
the COVID EIDL program’s lifespan.31 These improvements could assist in the identification of fraud on the back end and
throughout servicing the loan.

The CARES Act also allowed for COVID EIDL Advance payments. These payments could grant up to $10,000 to
qualified businesses within three days of applying for a COVID EIDL loan.32 COVID EIDL Advances were not required to
be repaid under the CARES Act. Businesses that applied for a COVID EIDL loan, but were denied the loan, were permitted
to keep and use the Advance. 33 Given the minimal assessments performed for the COVID EIDL Advances, these payments
were naturally at higher risk of fraud and abuse. In total, over $20 billion of the COVID EIDL’s funds were used for COVID
EIDL Advances. While only 3.9 million COVID EIDL loans were issued by the SBA, over 5.7 million COVID EIDL
Advances were issued.34

28
Id. At 35.
29
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 21-02, Inspection of Small Business Admonition’s Initial Disaster Assis-
tance Response to the Coronavirus Pandemic (Oct. 28, 2020).
30
Consolidated Appropriations Act, 2021, H.R. 133, 116th Cong. (2020).
31
William B. Shear, Gov.Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program:AdditionalActions Needed
to Improve Communication with Applicants and Address Fraud Risks (Jul. 2021).
32
CARES Act, H.R.748, 116th Cong. (2020).
33
Targeted and Supplemental Advance Frequently Asked Questions, U.S. Small Bus. Admin. (Apr. 28, 2021).
34
Bruce R. Lindsay, et al., Cong. Research Serv., R47509, SBA COVID-EIDL Financial Relief: Policy Options and Consider-
ations, 3 (Apr. 18, 2023).

8
B. Paycheck Protection Program

The PPP Program was the largest of the COVID Lending Programs.35 It was aimed at ensuring employees would
keep their jobs and continue getting paid during the height of the COVID-19 restrictions so the unemployment system
would not become overwhelmed. The program was structured as a modified version of the SBA’s 7(a) lending program. This
massive endeavor required the SBA to partner with financial institutions who would provide customers with loans which the
SBA would guarantee the purchase of. 36 While a statutory limit set the absolute maximum amount available to borrowers
for these loans, the SBA was still permitted to set even lower caps for these loans. Recipients of PPP loans were required to
use funds to retain staff and keep businesses operational during the lockdown period.37 If the business owner complied with
program requirements, the SBA would purchase the loan from the lender and forgive the outstanding debt.

Businesses were able to apply for two PPP program drawings. In order to receive complete forgiveness on first
draw PPP loans, borrowers were required to have fewer than 500 employees and to use 75 percent of their PPP loan for
maintaining payroll, but were also permitted to use the funds on expenses such as the businesses rent, mortgage, and
utilities.38 If borrowers complied with these terms, they would have their PPP loans fully forgiven. If borrowers fell short
of these standards, the amount forgiven by the SBA would decrease in relation to the borrower’s failure to comply with the
terms.39 For first draw of PPP loans, borrowers were permitted to borrow two and a half times their average 2019 or 2020
monthly payroll costs, up to a maximum of $10 million.40

Second draw PPP loans were intended for businesses that had already received a PPP loan, but still needed assistance
to maintain payroll.41 The second draw required borrowers show that they had no more than 300 employees and that they
had at least a 25 percent reduction in income from 2019 to 2020.42 In order to receive full forgiveness for second draw PPP
loans, borrowers needed to show that 60 percent of loan funds went to maintaining payroll and that the remaining funds were
used on permissible expenditures, such as rent and utilities.43 Businesses were permitted to borrow up to two and half times
their average monthly payroll costs from 2019 and 2020, up to a maximum of $2 million.44

The SBA’s role in the PPP Program was limited to coordinating with lenders, guaranteeing the purchase of the lender-
issued loans, and making forgiveness decisions. The financial institutions themselves were responsible for issuing these
loans and the SBA relied on these institutions to conduct outreach to borrowers. Most financial institutions left their existing
control environments in place for issuance, meaning that borrowers were subject to at least some scrutiny, monitoring, and
Know Your Customer (KYC) requirements, but were forced to comply with the programs self-certification requirements.

Borrowers had until the maturity date of their loan to submit a forgiveness application. The maturity date of PPP
loans varied between two and five years.45 Additionally, PPP loan payments were deferred for the first 10 months of the
program. Borrowers who had not submitted their forgiveness application after 10 months were required to begin making
regular loan payments.46

C. Restaurant Revitalization Fund

The RRF was created as part of the ARP and was intended to assist restaurants adversely impacted by the pandemic
and shutdown.47 The RRF provided grants up to $5 million per business location and no more than $10 million to businesses

35
While technically redundant, the Paycheck Protection Program will be referred to as the “PPP program” throughout this report.
36
Paycheck Protection Program First Draw Loans, U.S. Dept. of Treasury (Jan. 8, 2021).
37
Id.
38
Id.
39
Id.
40
Id.
41
Paycheck Protection Program Second Draw Loans, U.S. Dept. of Treasury (Jan. 8, 2021).
42
Id.
43
Id.
44
Id.
45
CARES Act, H.R.748, 116th Cong. (2020).
46
Paycheck Protection Program First Draw Loans, U.S. Dept. of Treasury (Jan. 8, 2021).
47
Cong. Research Serv., IF11819, SBA Restaurant Revitalization Fund Grants (Aug. 15, 2022).

9
with multiple locations.48 To qualify for an RRF grant, businesses were required to attest that they were a place in which
people gather for the purposes of eating or drinking. Businesses with more than 20 locations were not eligible.

In total, Congress allocated $28.6 billion for the RRF, of which $5 billion was reserved for businesses with fewer
than $500,000 gross income in 2019, with the remaining amount intended to be “equitably” split between businesses of all
incomes.49 While no official fraud estimate exists, as of March 2024, the SBA OIG indicated that $6 billion may have gone
to improper recipients.50 While it remains unknown how much of that $6 billion went to fraudulent recipients, at the very
least, this constitutes severe mismanagement. Given there was significantly more time to prepare to execute the RRF than
with the PPP Program or COVID EIDL, these improper payments are even more unjustified.

The RRF was fraught with other practical and legal issues outside of fraud. The ARP prioritized aid to specific
demographics of the population. 51 This resulted in requirements in the RRF program which prioritize women-owned
and socially or economically disadvantaged-owned businesses. This meant that for the first 21 days of the program, the
SBA selectively processed and fulfilled the loans of women and socially or economically disadvantaged applicants, rather
than businesses with the greatest economic need, or which posed the least risk to the SBA.52 Applicants were able to self-
certify belonging to these demographic groups. After 21 days, the SBA would then process and fund whatever remained to
individuals outside of those classifications, provided that some funds remained in the program.

Hundreds of thousands of businesses applied for RRF Grants - the funding was exhausted within 21 days, and very
little, if any, money went to businesses owned by individuals outside of the prioritized demographic groups.53 Given that
a substantial portion of applicants were denied access to this program on account of immutable characteristics, the United
States Sixth Circuit Court of Appeals found that the RRF’s prioritization of certain groups violated the Equal Protection
Clause of the Constitution.54 In response, the SBA rescinded the approvals for grants it had yet to fund and made these
funds available to assess the eligibility of applicants who had been de-prioritized, if funds remained, all applicants would be
considered equally regardless of their demographic group status.55

D. Shuttered Venue Operators Grant

The Shuttered Venue Operators Grant was intended to assist live venues, theaters, museums, and other venues whose
operations were challenged by the Pandemic. The SVOG program issued grants worth up to 45 percent of a borrower’s
gross earned revenue, as of 2019, to a maximum of $10 million.56 Eligible venues must have existed prior to March 2020.
Grantees who also received PPP loans prior to December 27, 2020, would have their SVOG grant reduced by the amount
of their PPP loan.57

In total, Congress provided $16.25 billion for the SVOG program.58 This program experienced substantial delays
in being established. Despite the legislation authorizing this program passing in December 2020, the SBA slow rolled the
programs layout until April 2021. Just as the SVOG program was set to go online, the SBA OIG identified crucial issues in
the program which resulted in additional two weeks of delays. This meant that the SVOG program did not start until midway
through 2021, around the same time as the RRF program which was created months later in the ARP. Both programs began
issuing grants over a year after the initial shutdown, nearing when Pandemic-era restrictions began to relax. Again, the SBA
had substantial time to set up this program and failed to do so adequately.

Given the relatively small size of the SVOG portfolio, especially when compared to that of the PPP and COVID
48
Id.
49
Id.
50
U.S. Small Bus. Admin., 24-09, SBA’s Restaurant Revitalization Fund Program Award Practices, 4 (Mar. 26, 2024).
51
Gabe Gutierrez & Fallon Gallagher, Suburban women helped Biden win in 2020, and he’s trying to keep them in his coalition this
year, NBC News (Feb. 6, 2024); Arnabu Syed, Democrats Launch $35 Million Push to Court Black, Latino, and Asians Voters in
Battleground States, Time (Jan. 9, 2024).
52
Cong. Research Serv., IF11819, SBA Restaurant Revitalization Fund Grants (Aug. 15, 2022).
53
Id.
54
Vitolo v. Guzman, 999 F.3d 353 (6th Cir. 2021).
55
Cong. Research Serv., IF11819, SBA Restaurant Revitalization Fund Grants (Aug. 15, 2022).
56
About SVOG, U.S. Small Bus. Admin. (Last visited Aug. 12, 2024).
57
Id.
58
Id.

10
EIDL programs, it has been subject to very limited oversight. The SBA OIG has indicated between 12 and 23 percent of
SVOG grants were made improperly, which could amount to between $1.9 billion and $3.7 billion.59

U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-04, SBA’s Internal Controls to Prevent Shuttered Venue Operators
59

Grants to Ineligible Applicants, 6 (Oct. 25, 2023).

11
III. Fraud Within the COVID EIDL Program
1. Introduction
From April 2020 through December 2021, the SBA issued approximately $400 billion worth of COVID EIDL
loans, Advances, and Targeted Advances.60 Of this $400 billion, the SBA OIG estimates that up to $136 billion worth of
lending went to fraudulent recipients, representing approximately 33 percent of all COVID EIDL funds.61 This fraud rate
is nearly four times higher than the much larger PPP portfolio.62 While the PPP Program had its own issues, a review of the
COVID Lending Programs makes it quite clear that the COVID EIDL program experienced substantially more problems
and it therefore should not serve as a model for future emergency lending programs.

The SBA OIG began identifying issues with the COVID EIDL program just months after it began.63 While the SBA
was generally receptive to OIG’s requests throughout the early stages of the pandemic, the SBA began to take firmer stances
against its Inspector General following the SBA OIG’s report on fraud in the pandemic programs.64 In fact, in response to the
SBA OIG’s investigation into programmatic fraud, the SBA created its own report, issued the same day as the SBA OIG’s
report, rebutting the SBA OIG’s findings. In refuting the SBA OIG’s estimate of $136 billion in COVID EIDL fraud and
$200 Billion total across all COVID Lending Programs, the SBA estimated total fraud across all programs totaled just $36
billion.65 Given that, at the time of the SBA’s estimate, the SBA OIG and law enforcement agencies had already recollected
over $30 billion in just fraudulent COVID EIDL funds, and the SBA OIG had indicated that it had a 100-years’ worth of
backlogged fraud cases to review, the SBA’s fraud estimate appears baseless, if not entirely inconceivable.66

Throughout this investigation, the Biden-Harris SBA made various statements and implications placing blame with
the Trump-Pence SBA for the scale of fraud in the COVID Lending Programs.67 While it is true that fraud occurred at a
higher rate the moment these untested programs were set up, it was always known that fraud would occur. However, it is
necessary to have a complete and accurate accounting of the universe of fraud so appropriate actions can be taken to hold
these criminals accountable and make taxpayers whole. Additionally, it is crucial to know how much fraud occurred as
Congress looks to evaluate the future role of the SBA in disasters. Deflecting blame is a transparent attempt by the SBA to
downplay the amount of fraud within these programs in an effort to avoid scrutiny and defer responsibility to the previous
administration. For this reason, in addition to the subject matter expertise held by the SBA OIG, in absence of any earnest
efforts by the SBA to define the amount of fraud in these programs, the SBA OIG’s estimate of $136 billion in fraudulent
funds issued in the COVID EIDL program is more likely to be correct.68

Despite SBA’s efforts to defer responsibility and make oversight more challenging, the American people deserve
an honest assessment of how their taxpayer dollars were used. The COVID period, and the shutdown more broadly, was
a terrible time for hundreds of millions of Americans. Many were in need of support which was either denied or delayed
because a fraudster cut in line and took that which they were not eligible for. The American people deserve to know what
went wrong in these programs, and how to better craft programs in the case of any future emergency.

The structure of the COVID EIDL program was inherently flawed and greatly increased fraud risks while
simultaneously reducing the SBA’s ability to detect fraud. In future programs, numerous structural, control, and programmatic
changes should be implemented to address these risks. Further, lawmakers should reconsider whether the SBA, or any
60
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 1
(Jun. 27, 2023).
61
Id. at 11.
62
Id. at 8.
63
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 20-16, Serious Concerns of Potential Fraud in Economic Injury Disaster
Loan Program Pertaining to the Response to COVID-19 (Jul. 28, 2020).
64
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 24
(Jun. 27, 2023); see also U.S. Small Bus. Admin., Protecting the Integrity of the Pandemic Relief Programs (Jun. 27, 2023).
65
U.S. Small Bus. Admin., Protecting the Integrity of the Pandemic Relief Programs, 6 (Jun. 27, 2023).
66
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 7
(Jun. 27, 2023).
67
U.S. Small Bus. Admin., Protecting the Integrity of the Pandemic Relief Programs, 3 (Jun. 27, 2023).
68
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 8
(Jun. 27, 2023); See also U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facili-
tated Fraud in the Paycheck Protection Program, 13 (Dec. 2022).

12
relatively small government agency, is capable of being placed in charge of such an enormous program.

2. Self-certification
By far the most poorly calibrated aspect of the COVID EIDL program was its reliance on self-certification. Self-
certification allows borrowers to attest that the information they’ve provided is true, without requiring additional validation,
such as providing supporting documents like tax returns, business foundation documents, or sales records. In the COVID
EIDL program, businesses were allowed to self-certify essentially all aspects of the loan application, other than their credit
score.69

On a basic level, self-certification poses a substantial risk for the government in any program, but especially loan
programs. With self-certification, the only thing standing in the way of fraud is an applicant’s willingness to lie or risk legal
punishment. This is not a substantial enough incentive to reduce fraud risks to acceptable levels.70 Regardless of program
size, need, or capacity, self-certification is dangerous to the government and offers very little protection against fraud.71

Applicants for the COVID EIDL program were required to fill out a certificate of eligibility for the loans and grants,
in addition to their application.72 This document evolved throughout the program, but generally required borrowers to list
their business name, a contact, bank information, and their Social Security or Federal Employer Identification Number
(FEIN). Applicants would then have to select a checkbox to indicate which of the eight types of eligible businesses applied
to them. Lastly, applicants would have to select checkboxes to indicate that they weren’t engaged in otherwise illegal
activity. In total, the Office of Management and Budget (OMB) estimated that it would take no more than 10 minutes to
complete the form.

Ideally, the SBA would have the ability to check whether the names provided by applicants match the bank account
information and the identification number provided on the application. This would allow the SBA to detect at least some
portion of potential fraud. Further, a Federal Employer Identification Number (FEIN) or Social Security Number (SSN)
could be checked against the bank account information or the business name. Unfortunately, due to a combination of the
SBA’s limited capacity, as well as system and human error, it is clear that numerous fraudsters went undetected or had the
flags on their application incorrectly cleared. 73

In reality, given the considerably smaller size of the SBA at the start of the pandemic, the SBA was forced to use
contractors and to perform very little direct oversight of those contractors and their management of the loans. Borrowers
would submit their applications and self-certifications to the SBA through a contractor. The contractor would submit
recommendations to the SBA on whether the SBA should fund the loan and flagged any concerns. SBA staff were then
tasked with reviewing the flags and recommendations and deciding whether to fund the loan. SBA loan staff were expected
to work through these applications quickly, and to review the applications for no more than 15 minutes.74 Further, team
leaders were meant to spend less than six minutes reviewing loan staff’s decisions.75 Given the minimal eligibility criteria
for these loans and the speed at which SBA staff was meant to review loans, SBA loan review staff was incentivized to work
quickly, which contributed to flags being cleared for loans the SBA should have rejected.

While SBA’s flagging system likely missed substantial amounts of fraud, it is possible that too many loans were
flagged which, given the SBA’s review process, were more likely to be ignored by reviewers. In total, the SBA conducted
over 3.4 million human-led reviews of flagged loans, totaling approximately 3,000 loans per day.76 For reference, the SBA
OIG indicated that a typical fraud investigation takes it over 250 days, while the SBA’s “human led reviews,” were churned
69
Self-Certification procedures May Increase Fraud Risk In Pandemic Response Programs, Pandemic Recovery and Oversight Com-
mittee (Nov. 13, 2020).
70
Id.
71
Id.
72
U.S. Small Business Administration COVID-19 Economic Injury Disaster Loan (EIDL) Application, U.S. Small Bus. Admin (2020)
(SBA Form 3501).
73
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 12
(Jun. 27, 2023).
74
U.S. Gov. Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program, 14 (Jul. 2021).
75
Id.
76
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 27
(Jun. 27, 2023).

13
out at a pace of two reviews per minute.77 Individuals reviewing such a gargantuan number of loans, at only a surface level,
while being encouraged to work quickly are unlikely to perform efficiently. The SBA OIG has identified numerous instances
where supposed SBA “flags” had been overridden, either by a human or computer.78 While self-certification allowed for
these applications to be submitted and for the problem to escalate, the issue was exacerbated by the number of fraudsters
who had their flags eventually cleared or ignored.

Speed played a role in a substantial amount of fraud in this program, but clearing flagged loans that were eventually
shown to have fraudulent recipients shows that self-certification itself was the driving factor of fraud, not just a faulty
flagging system. The SBA simply lacked enough valid information about applicants to mitigate fraud risks on the front-end
and derived too little information on the applications to effectively check borrower information later.

In addition to the potential for fraudsters to simply fake information on their applications, there are also a substantial
number of applications for which the SBA may not be able to immediately detect fraud due to identity theft. Millions of
Americans’ data and information is unfortunately available for individuals to buy and sell online. There are thousands
of stolen identities for sale in the dark corners of the internet. Purchasing one of these identities can cost as little as $8.79
With just a small financial commitment, fraudsters could be reasonably certain that they would make at least $10,000 right
away through the EIDL Advance, and potentially more later if their loan was approved. Obviously, this poses a substantial
challenge, as fraudsters who used legitimate, but stolen, personal information may entirely avoid detection by the SBA’s
flags on the front end.

Outside of self-certification’s insufficiency in discouraging or preventing fraud, it also creates challenges in identifying
fraud. As noted, there’s a chance these applications contain entirely fraudulent or stolen identification information. Since
this is the case, the SBA would have limited ability to use the information on the application and self-certification form to
identify and prosecute the individuals responsible for instances of fraud.

Making matters worse, the COVID EIDL Advance was nearly immediately issued to borrowers after their application
was submitted.80 While the SBA did perform some background research on the borrowers that submitted applications, the
grants were issued before conclusive decisions on loan eligibility were determined. This means that even when fraud was
blatant enough for the SBA’s systems to detect, these applicants could still possibly receive a $10,000 grant. While the SBA
could attempt to recollect these ill-gotten grants, it would likely not be cost effective to do so.

In total, self-certification in the COVID EIDL program was an improperly calibrated risk, which Congress
acknowledged in the 2021 supplemental appropriation by removing self-certification as the basis for loan eligibility.81 Future
emergency lending programs should avoid self-certification entirely.

3. Programmatic Structure
The SBA cannot be blamed for the entirety of the incomprehensible amount of fraud in this program. While the
SBA’s mismanagement of this portfolio was responsible for increasing fraud risks, the design of the COVID EIDL program
was not well tailored to mitigating fraud risks. The EIDL program upon which the COVID EIDL program is based is mostly
intended to help businesses rebuild or cope with the impact of a single devastating incident or disaster, but is also available
in more protracted disasters such as droughts. 82 Given how different the needs are between businesses recovering from a
single incident, and those who may experience weeks or months without income due to a virus, modeling the COVID EIDL
program on the SBA’s EIDL program was an imperfect fit. With this in mind, certain changes to the programs’ structure
should be considered to reduce fraud risks in future programs while also meeting the needs of the moment.

77
Stolen Taxpayer Funds: Reviewing the SBA and OIG Reports of Fraud in Pandemic Lending Programs: Hearing Before H. Comm.
On Small Bus. 118th Cong., 28 (Jul. 13, 2023) (Questions by Representative Van Duyne).
78
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun.
27, 2023).
79
Brian Stack, Here’s How Much Your Personal Information Is Selling for on the Dark Web, Experian (Dec. 6, 2017).
80
William B. Shear, Gov.Accountability Off., GAO-21-589, Economic Injury Disaster Loan Program:AdditionalActions Needed
to Improve Communication with Applicants and Address Fraud Risks, 5 (Jul. 2021).
81
Consolidated Appropriations Act, 2021, H.R.133, 116th Cong. (2020).
82
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandemic,
4 (Sep. 14, 2023).

14
A. Incentive Structure

The Committee’s findings suggest that the SBA had less incentive to mitigate fraud risks in the COVID EIDL
program than private sector financial institutions did in the PPP Program. In fact, the Committee’s investigation revealed
that the SBA believed they had policy incentives against collecting a large part of the COVID EIDL and PPP portfolios.83
When applied to private sector lenders, an incentive to increase risk and lack of an incentive to reduce risk is often called
“moral hazard.” Over the course of the Committee’s investigation, we found that the SBA consistently failed to adequately
assess the COVID EIDL program and the risk this program posed to the taxpayer. Further, the SBA’s behavior suggests
that it was far more concerned with appearing kind and magnanimous than executing an effective disaster relief program.84
These findings show an inherent risk in government direct lending programs akin to moral hazard.

While perceptual risks exist when the government too frivolously lends money, there is little other incentive for
government actors to minimize risk. There is also a chance that forgiving large portions of debt may receive some public
support, especially among the debtors. Government agencies can generally shift the burden of bad debt from their balance
sheet to the taxpayer. Additionally, agencies are administered by politicians, whose core interest is not necessarily fiscal
responsibility or fraud mitigation, but rather maintaining their elected position. This does not sufficiently incentivize fiscal
responsibility on behalf of the agency. In fact, it can incentivize fiscal irresponsibility, as forgiving loans for partisan, rather
than economic reasons, has become quite common in the Biden-Harris Administration.85 While the term “moral hazard”
typically applies to financial institutions who have little incentive to avoid losses in a loan program or could benefit from
the losses, the mixed incentive structure here creates a similar issue. Moral hazard does not cause fraud itself but creates or
demonstrates an environment with little incentive to mitigate fraud risks, as is the case here. The SBA’s struggle between
these incentives is best exemplified by the SBA’s decision to end collections on COVID EIDL and PPP loans valued at
$100,000 or less.

The Committee will discuss the decision to end collections on loans under or at $100,000 in more detail in a
separate report, but in 2022, the SBA decided to “end active collections, including referral to treasury,” for all delinquent
COVID EIDL and PPP loans valued at $100,000 or less.86 While this decision was ultimately reversed, it had the potential to
drastically increase the amount of successful fraud in this program by reducing servicing actions by the SBA and the SBA’s
interactions with the borrower. This decision also displays a crucial flaw in the COVID EIDL and other COVID Lending
Programs: minimal incentive to effectively manage this program and its risks. The SBA’s decision to end collections was
premised on a study of just the PPP Program and incomplete estimates from the Treasury which indicated that it would
not be cost effective to take servicing actions on these loans, as well as “equity” factors.87 From the outset, the Committee
struggled to understand how this could possibly be accurate. It defies common sense to suggest that collecting upon a loan
portfolio of this magnitude is somehow not cost effective.

As noted, the SBA premised its decision on a report regarding the PPP Program; the SBA conducted no real analysis
on the COVID EIDL program.88 While the PPP Program and COVID EIDL programs have some similarities, they are still
distinct enough that separate analyses must be performed on them, as this report is doing. The decision not to pursue this
loan set, paired with the fact that the SBA also didn’t conduct a fraud risk assessment on the COVID EIDL program until
three years after the program began, suggests that the SBA did not ever seriously consider the risks of this program, and this
is likely due to the lack of risk the SBA faces in forgoing collections.

Further, not collecting such a large loan portfolio containing loans with substantial value is highly unlikely to be
the most cost-effective option for the taxpayer. Not all borrowers with delinquent debt are equally situated, and some may
indeed possess some capacity to make or resume payments. Therefore, dismissing the debts of this entire class of people
without conducting more rigorous financial assessments, such as triaging different loans based on other characteristics, is
83
Memorandum from Jihoon Kim, Director, Small Bus. Admin. Office of Capital Access, to Isabella Casillas Guzman, Administrator,
U.S. Small Bus. Admin. (Apr. 5, 2022)(On file with Committee).
84
Id.
85
Mart Walrath-Holdridge, Keep an Eye on Your Inbox: 25 Million Student Loan Borrowers to Get Email on Forgiveness, USA Today
(Aug. 2, 2024).
86
Memorandum from Jihoon Kim, Director, Small Bus. Admin. Office of Capital Access, to Isabella Casillas Guzman, Administrator,
U.S. Small Bus. Admin., 2 (Apr. 5, 2022)(On file with Committee).
87
Id.
88
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun.
27, 2023); See also William B. Shear, Gov. Accountability Off., GAO-21-472T, Actions Needed to Improve COVID-19 Loans’
Internal Controls and Reduce Their Susceptibility to Fraud, 5 (Mar. 24, 2021).

15
inherently suspect. At the time the SBA made its decisions to end collections, less than 2 percent of COVID EIDL loans
had become due. This exemplifies how little consideration the SBA had for the effective management of this program, and
its risks. The SBA bore little risk in forgoing these debts and was thus overly willing to end collection actions and reduce
its servicing burden and workload.

A protracted debate, spanning over 18 months, ensued between the Committee and the SBA on this topic. Despite
making multiple overtures to the SBA to elicit more detail and explanation, primarily to the political appointees with whom
the Committee is intended to interact, the SBA proved unwilling or unable to fully rationalize this decision. The SBA
OIG also had similar issues with the SBA’s decision and issued multiple reports discussing the consequences of forgoing
collections. After a year and a half of inquiry, the SBA relented and restarted collection actions on these loans.

The Committee’s core issue with this decision was, by the SBA stating it was ending collections “including referral
to Treasury,” it appeared that the SBA had entirely abandoned collection on these loans. After asking multiple SBA political
appointees whether this understanding was accurate, the Committee was put in contact with an SBA career official within the
Office of Financial Program Operations. The SBA career official succinctly explained that the SBA’s phrasing of “including
referral to Treasury,” was not intended to reflect the SBA’s specific policy, but an effort to match the verbiage found in OMB
guidance governing the disposition of federal debts.89 The SBA employee indicated that the SBA had mostly continued its
in-house collection activities over this period.90 Conversely, the SBA employee suggested that, unless the SBA recanted its
decision, loans that weren’t paid would likely still be written off.91

While this testimony, and the SBA’s abandonment of its initial decision, reduced the Committee’s concerns, it
also highlights other issues. Notably, the contractor report the SBA relied on to support its argument that it was not cost-
effective to collect, included the cost for actions the SBA allegedly continued to perform. 92 Further, the estimates and
assumptions within the SBA’s analysis were overly pessimistic regarding the SBA’s expected collection. This calls into
question the SBA’s understanding of the contractor’s report, and how well it considered this decision in total. Again, given
the minimal risk to the SBA in essentially forgiving these loans, its lack of consideration for these details simply displays
how government agencies managing such lending programs can have little incentive to actually maximize collections.

This decision was undone before it had the chance to massively increase the amount of successful fraud. If the
SBA had stood by its decision and not collected on these loans, eventually the SBA would be forced to write off all of the
delinquent debts under the threshold. In doing so, the SBA would be making it substantially more difficult to identify fraud
in the future and to pursue those fraudulent loans which were written off. The SBA OIG estimated that approximately $11
billion worth of loans valued at $100,000 or less were fraudulent. While the SBA claims that fraudulent loans would still be
collected upon, the SBA clearly lacks an understanding of the scale of fraud and therefore lacks knowledge of which loans
are fraudulent. By compelling the SBA to reverse course, the Committee helped to avoid this potentially disastrous outcome.

As part of its decision to end active collections on these loans, the SBA also indicated that “equity” factors suggest
that the SBA should avoid collection action on loans.93 In fact, in discussions with the Committee, the SBA suggested that
it did not want to be in a position where it was strong-arming a small business for repayment, and argued that collections
would have a negative impact on sole proprietorships. This further display’s the toxic mixture of incentivizes in government
direct lending program. Unlike the PPP Program, this program was set up, statutorily, to be repaid. Had Congress, the voice
of the American people, wanted something different, the legislation would have indicated such. The SBA is not doing
anything unfair, unreasonable, or inequitable by ensuring individuals pay their debts; rather, they are complying with the
will of the people.

While OMB Circular A-129 indicates that the SBA can decide to avoid collection action on certain loans unilaterally,
it states that this must be for cost effectiveness reasons.94 That same OMB guidance, provides the SBA no method to forgo

89
Exec. Off. Of the President, Circular No. A-129, Policies for Federal Credit Programs and Non-Tax Receivables (Jan. 2013).
90
Transcribed Interview with Jihoon Kim, Director, Small Bus. Admin, Off. of Fin. Prog. Ops, 36-37 (Jun. 7, 2024).
91
Id. at 37.
92
Memorandum from Jihoon Kim, Director, Small Bus. Admin. Off. of Fin. Prog. Ops., to Isabella Casillas Guzman, Administrator,
U.S. Small Bus. Admin., 5 (Apr. 5, 2022)(On file with Committee); Transcribed Interview with Jihoon Kim, Director, Small Bus.
Admin, Off. of Fin. Prog. Ops, 37 (Jun. 7, 2024).
93
Memorandum from Jihoon Kim, Director, Small Bus. Admin. Off. of Fin. Prog. Ops, to Isabella Casillas Guzman, Administrator,
U.S. Small Bus. Admin., 5 (Apr. 5, 2022)(On file with Committee).
94
Exec. Off. Of the President, Circular No. A-129, Policies for Federal Credit Programs and Non-Tax Receivables (Jan. 2013).

16
collections for what it believes are public policy reasons.95 When operating as a lender, preoccupations with optics and
sympathy result in high-risk environments ripe for fraud. Further, essentially forgiving large portions of debt could increase
risk in future programs, as borrowers may believe there is little incentive to repay their loans.96

Together, the SBA’s decision to end collections was premised on a faulty report, with conclusions drawn based on
comparisons to incomparable loan program, which indicated that collections would not be cost effective. Private lenders,
who are subject to the consequences of essentially forgiving tens of billions of dollars of debt and would experience a
financial loss from issuing fraudulent loans, would certainly have taken more time to assess this report and make a more
reasoned decision. Future government emergency lending programs should consider options that better address the mixed
incentives of agencies, including assessing whether a direct lending program by a government agency is appropriate at all.

B. Lump Sum payments

While fraud is unfortunately always prevalent in government programs, certain structural and programmatic decisions
can increase the likelihood of fraud, either by removing hurdles to potential fraud, or by providing an opportunity overly
ripe for abuse. One of the COVID EIDL program’s major structural issues is that it provided the entirety of its benefits up-
front without requiring additional work by the borrowers. Upon satisfying the program’s criteria, borrowers were approved
for loans and the entirety of the loan value was given to the borrower. This presented an appealing opportunity for potential
fraudsters, who could theoretically apply for and receive multiple loans using random or inaccurate information, before
disappearing without paying the loans. Since these fraudsters could use substantial amounts of inaccurate information in
their applications and self-certifications, it could eventually prove nearly impossible to track these people down. While
fraudsters will always try to exploit these programs, there is nothing about the COVID EIDL program which required the
entirety of the loan to be issued to a borrower at one time.

Congress intended for the COVID EIDL program to make up for potentially multiple months of economic hardship
in the wake of the pandemic.97 At the same time, the program’s structure provided lump-sum payments to the borrowers.
Given that COVID EIDL was intended to make up for losses accruing over multiple months, it is likely that COVID EIDL
loans could have been issued in multiple payments or installments over the course of multiple months. In doing so, the
potential for fraud would decrease, as well as providing some other discrete advantages, such as better targeting benefits.
Since lockdowns and business restrictions were mostly determined by state and local laws, granting these benefits at one
time ignores the reality that some businesses may have restrictions longer than others.

One basic idea for fraud management is the Fraud Triangle, which explains the factors that drive a fraudster toward
committing fraud. The fraud triangle states that financial needs, perceived opportunity, and rationalization on behalf of the
criminal drive their decision to commit fraud. 98 On a basic level, making multiple, smaller payments to borrowers over
time would reduce the appeal of committing fraud, as it becomes more difficult to rationalize and is less responsive to need.
While many criminals would risk hefty prison sentences to steal hundreds of thousands of dollars in one moment, criminals
are substantially less likely to accept those same risks for substantially smaller sums, paid over of time. By affording all of
the benefits at one time, it essentially created a lottery for any fraudster capable of making up names and numbers on their
applications.

While structuring these programs to issue multiple payments would increase inefficiencies, the cost of these
inefficiencies is likely dwarfed by the value of fraud in the COVID Lending Programs. Additionally, given that each
individual payment would be smaller, additional controls could be added over time, and future payments could be withheld,
the risk of each of these payments is substantially less than the entire loan being issued to the borrower at once. By requiring
these payments to take place over time, it would also increase the number of touchpoints between a would-be fraudster and
the SBA or lender. This not only decreases the incentive for fraudsters to commit this fraud, but it also provides the SBA

95
Id.
96
Bruce R. Lindsay, et al., Cong. Research Serv., R47509, SBA COVID-EIDL Financial Relief: Policy Options and Consider-
ations, 10 (Apr. 18, 2023).
97
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandemic,
4 (Sep. 14, 2023).
98
Fraud 101: What Is Fraud?, Assoc. of Certified Fraud Examiners (Last visited Aug, 15, 2024).

17
with an opportunity to perform more actions which could assist in the identification of fraud.99 Moreover, by spreading these
payments out, it would also limit the opportunities for borrowers, knowingly or unknowingly, to use the funds in a manner
not considered by the law.

Spreading such payments over time would also reduce the need to reduce or streamline controls, especially for later
payments. While the need to get money out quickly may reemerge in future programs, multiple or installment payments would
allow for only the first installment to be received with reduced scrutiny and allow for a more robust control environment and
additional documentation requirements in future payments. This was likely the intent of the COVID EIDL Advances, but
this aspect of the program and the SBA management of it was also improperly tailored to fraud risks it presented.

COVID EIDL Advances could be issued within hours or days of the receipt of a COVID EIDL Loan application, based
on self-certification, and with very little, if any, vetting by the SBA. Given the drastically reduced eligibility criteria, self-
certification, and the substandard control environment within the SBA, its automated systems were ill-equipped to identify
fraudulent applications, and it lacked the capacity to review such a gargantuan amount of COVID EIDL Applications. In fact,
the SBA OIG found that the SBA did not even assess whether the employee count listed on the COVID EIDL applications
was legitimate.100 This is a serious issue, not only because of the obvious risk of fraud associated with conducting very
minimal reviews, but because the value of COVID EIDL Advances was determined by the claimed employee count. This
resulted in nearly 2 million more COVID EIDL Advances being issued than COVID EIDL loans--with 5.7 million and 3.9
million issued, respectively.101 Moreover, the COVID EIDL Advance portion of this program exhausted its funding long
before the COVID EIDL Loan portion.

This resulted in at least 672,000, but potentially as many as 1.6 million, advances being issued to individuals who
were either ineligible, or never had a conclusive determination on their loan eligibility, potentially making up nearly a third
of all COVID EIDL Advances.102 While funds did need to be rapidly distributed to businesses, and the expectation was
that fraud would be caught on the back end, this approach was far too risky and did not adequately consider the costs of
reclaiming fraudulent funds. Since COVID EIDL Advances were limited to $10,000, it is unlikely that SBA could recover
the money issued to fraudsters without expending far more than it had given away. Some amount of due diligence must
be performed when the government, or anyone else, is issuing loans, including smaller value loans, as the chances of
recovering such amounts is much lower than for larger value loans.

As discussed in more detail in Subsection 5, the SBA was a small agency before it was given the immense
responsibility of managing these programs and lacked the capacity to simultaneously hire thousands of people and review
millions of loan applications. Further, self-certification and control weaknesses resulted in the SBA receiving too little data
up-front, when it needed to disposition the entire loan’s value, and therefore the SBA was unable to effectively identify fraud
when performing loans’ reviews. Under these circumstances, the COVID EIDL Advances presented far too much fraud
risk, but that does not inherently mean that the idea of providing stopgap funding with fewer restrictions is unworkable.
Larger, more well resourced agencies, or institutions with a deeper understanding of risk and controls, would likely be able
to implement this program more effectively under the circumstances. Further, in absence of an effective and constitutional
means of efficiently reclaiming fraud in lower value loans, lawmakers should assume that, in programs where smaller sums
are distributed with nearly no eligibility standards, fraud will be common and not financially worth reclaiming.

In fact, in the SVOG program, the SBA planned to issue multiple, smaller payments to grant recipients it deemed
moderate and high risk, instead of issuing a single advance payment.103 Though the SBA failed to follow through on this
plan, the reasoning behind it was sound. Multiple payments allow for further and deeper analysis of applicants and reduces
fraud risk in each payment.104 While the SVOG program was a grant program, similar principles apply in the other COVID

99
U. S. Gov. Accountability Off., GAO-15-593SP, A Framework for Managing Fraud Risk in Emergency Assistance Programs, 41
(Jul. 2015); Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19
Pandemic, 14 (Sep. 14, 2023).
100
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-01, SBA’s Emergency EIDL Grants to Sole Proprietors and Indepen-
dent Contractors, 3(Oct. 7, 2021).
101
Bruce R. Lindsay, et al., Cong. Research Serv., R47509, SBA COVID-EIDL Financial Relief: Policy Options and Consider-
ations, 4-5 (Apr. 18, 2023).
102
Johana Ayers, Gov. Accountability Off., GAO-23-105331, COVID Relief: Fraud Schemes and Indicators in SBA Pandemic
Programs, 52 (Jul. 2021).
103
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandem-
ic, 14 (Sep. 14, 2023).
104
Id.

18
lending programs.

Congress’ and the SBA’s goal of getting this money out quickly appeared reasonable under the circumstances, but
it overlooked numerous important details and potential alternatives in order to make creating these programs as fast as
possible. This includes the simple fact that the entire benefit in the COVID EIDL program is given to borrowers up-front
and through self-certification, thereby creating a pay-and-chase system.105 Pay-and-chase systems function by permissively
allowing fraud to occur, then working to reclaim those funds. While pay-and-chase systems are never ideal and are otherwise
prohibited by law, this situation is made worse as the potential fraudster that law enforcement is chasing down could be
using a stolen or non-existent identity.

Future pandemic relief programs should consider whether it is appropriate to issue payments in a lump sum or single
advanced payment, or whether it is possible to issue relief payments in installments, or at least in multiple phases. In the next
major disaster, it is likely that lawmakers and agencies will again feel the need to issue money quickly and feel compelled
to reduce or streamline controls. While this desire should be avoided, multiple payments would allow for the first payment
to be issued with less scrutiny by the agency, while still allowing for more scrutiny to occur for further funding.

C. Additional Documentation Requirements

The benefits associated with spreading COVID EIDL payments over time could also be paired with requirements
that borrowers submit additional documentation at the end of, or throughout the loan period. While less effective at detecting
fraud than controls utilized during the application process, such back-end checks can assist in identifying fraud. For reference,
through these back-end checks, the SBA was able to identify approximately 180,000 improper PPP loans.106 While resolving
the initial control failure would be more effective at mitigating fraud-- an ounce of prevention is worth a pound of cure—
these back-end checks still assisted in fraud mitigation. Further, the GAO has indicated that “making contact with program
enrollees or beneficiaries for additional information can also be used to help prevent and detect potential fraud.”107 This
constant contact with borrowers provides an opportunity to assess the individual borrower and seek additional information
to validate the loan or account. In the COVID EIDL program, there was very little contact between the borrowers and the
SBA. Borrowers could apply entirely remotely, have their loan funded, and pay off their loan without ever being contacted
by the SBA outside of automated letters and emails.

Like in the COVID EIDL program, PPP loan recipients would receive the entirety of their funds up-front with
similar eligibility criteria. In order to receive the maximal benefit of the PPP Program, total loan forgiveness, borrowers were
required to submit a forgiveness application, validate how these funds were spent, and likely send additional documentation
to the SBA.108 While loans under $150,000 did not explicitly require additional documentation to be provided to the SBA,
borrowers were still required to submit a forgiveness application with numerous details and to provide documentation at the
SBA’s request.109

The requirement to apply for and receive forgiveness, in and of itself, provided the SBA with a valuable opportunity
to detect fraud. 110 On a basic level, borrowers failing to complete their forgiveness applications was a strong indicator
of fraud. Further, applicants would have to show they qualify for forgiveness. This gives the SBA insight into how the
borrower spent the money, and some background details on the business itself, which the SBA can use to assist in fraud
identification and prosecution. Additionally, loan applications can be checked against applicants’ forgiveness applications
to detect discrepancies, further assisting in fraud identification.

While PPP lenders had similar criteria for issuing loans as the SBA had for COVID EIDL, their controls were still
more rigorous and well tested than the controls in the COVID EIDL program. While the more rigorous control environment

105
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 23
(Jun. 27, 2023).
106
U. S. Gov. Accountability Off., GAO-23-10533, COVID RELIEF: Fraud Schemes and Indicators in SBA Pandemic Programs, 50
(May 16, 2013).
107
U. S. Gov. Accountability Off., GAO-15-593SP, A Framework for Managing Fraud Risk in Emergency Assistance Programs, 41
(Jul. 2015).
108
Paycheck Protection Program First Draw Loans, U.S. Dept. of Treasury (Jan. 8, 2021).
109
PPP Loan Forgiveness, U.S. Small Bus. Admin. (Last Visited Aug. 16, 2024).
110
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 17
(Jun. 27, 2023).

19
used by lenders, in themselves, substantially reduced fraud risk, the basic structure of the PPP Program also mitigated some
fraud risk compared to COVID EIDL through this requirement. Conversely, efforts to increase oversight of borrowers
throughout the loan process would increase workload and inefficiencies, and potentially be too cumbersome for the SBA, or
many other agencies, to undertake; further highlighting government’s weakness as a direct lender.

To reduce fraud risks in future programs, the structural concerns in the COVID EIDL program should be considered
together. Borrowers should not be given such tremendous benefits in one instance and should be required to prove or
demonstrate their loan eligibility with documentation before receiving their full benefit. Further, whether the government
should directly issue loans in such a program should be considered. This type of approach should allow for a similarly rapid
dispersal of funds, while substantially mitigating the cost, appeal, and success of fraud in these programs, and provide some
other advantages in better targeting aid.

4. Control Environment
An essential theme present in every assessment of fraud in the COVID EIDL program is the substandard control
environment within the SBA. In fact, the SBA OIG had warned the SBA about its controls before any loans had ever
been issued.111 Both the GAO and SBA OIG have repeatedly stated that the weak controls were responsible for immense
amounts of the fraud in the COVID EIDL program. Despite the warnings it received in advance, the SBA initially relaxed its
controls to facilitate rapid lending and has struggled immensely to develop adequate controls through to the present day.112
In addition to the SBA’s substandard controls, the SBA was not able to effectively ensure that its employees, partners, and
contractors utilized the controls and policies it developed.

The reduction of controls and removal of policies was initially spurred by Congress, who mandated that loans be
issued based on credit scores and self-certification alone in the CARES Act. The SBA OIG warned the SBA about the risks
of removing its controls in one of its earliest reports on COVID EIDL, finding that the SBA has historically struggled to
implement adequate controls related to borrower eligibility for loans.113 The SBA OIG’s warning proved prophetic, and
over the course of the pandemic and after, the SBA struggled to implement controls to address the most basic and obvious
of risks.

The most impactful control the SBA failed to implement was the tax transcript requirement. Upon realizing the
issues with self-certification, Congress moved to allow the SBA to require tax transcripts for COVID EIDL applicants.114
The removal of self-certification was a major step in making the program more resistant to fraud and allowed the SBA to
improve its other controls through better data, but due to mismanagement, the SBA took over four months to implement the
tax transcript requirements during 2021.115 This provision is a key tool in empowering the SBA to combat fraud, as the tax
documents contain far more objective information than the self-certification forms, and these documents have a much higher
degree of fidelity. Despite the importance of implementing this requirement, and the fact that some of the SBA’s contractors
had started implementing this requirement within a month of the legislation being signed, the SBA and its management
waited months.116 This allowed more fraud to occur, as the SBA OIG found when it tested the SBA’s control environments
before and after the implementation of this requirement and related controls, and found a nearly 27 percent improvement in
the effectiveness of the SBA’s controls.117

The SBA OIG also found that the SBA’s controls and systems were insufficient to identify all applications from
foreign or duplicate IP addresses and to withhold funding from these applicants.118 While U.S. citizens living abroad who
111
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 20-11, White Paper: Risk Awareness and Lessons Learned From Prior
Audits of Economic Stimulus Loans (Apr. 3, 2020).
112
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 21-02, Inspection of Small Business Admonition’s Initial Disaster Assis-
tance Response to the Coronavirus Pandemic, 5 (Oct. 28, 2020).
113
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 20-11, White Paper: Risk Awareness and Lessons Learned From Prior
Audits of Economic Stimulus Loans (Apr. 3, 2020).
114
Consolidated Appropriations Act, 2021, H.R.133, 116th Cong. (2020).
115
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-22, Follow-up inspection of SBA’s internal Controls to Prevent
COVID-19 EIDLS to Ineligible Applicants, 2 (Sep. 29, 2022).
116
Id. at 5.
117
Id.
118
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 12
(Jun. 27, 2023).

20
operate a business within the U.S. were entitled to COVID EIDL loans, these situations are relatively rare. Despite its
rarity, the SBA OIG initially found that over $1.3 billion dollars were disbursed to applicants with foreign IP addresses.
Upon further review, the SBA OIG identified over $55 billion of potentially fraudulent COVID EIDL loans submitted from
foreign or duplicative IP Addresses.119 This includes issuing loans to fraudsters in hostile foreign nations, with over 100
COVID EIDL loans being issued in each of Russia, China, Iran, Cuba, and Venezuela.120

Further, the SBA failed to implement sufficient controls related to determining the borrowers’ business start date.121
To qualify for COVID EIDL, businesses must have existed prior to January 1, 2020. Over $1 Billion in COVID EIDL loans
and grants were issued without verifying the businesses satisfied this requirement. Failing to confirm the businesses’ start
date gave fraudsters the opportunity to start a fake business and provide legitimate appearing documentation to the SBA for
their loan, harming efforts to detect fraud.

Additionally, in November 2021, the SBA OIG found that the SBA was issuing loans to individuals in Treasury’s Do
Not Pay (DNP) system.122 The purpose of the DNP system is to aid agencies in avoiding payments to ineligible recipients.
One of the reasons an individual would be in the DNP system is having defrauded the government in the past. Despite the
risks of lending more money to known fraudsters, the SBA OIG found that approximately $3 billion worth of loans went to
ineligible recipients or fraudsters on the DNP list.123 Subsequent findings from the SBA OIG show that, even after the SBA
instituted controls for individuals on the DNP list, over $100 million still went to improper recipients.124

In July 2023, the SBA OIG published its report on fraud within the PPP Program and COVID EIDL programs.
In this report, the SBA OIG used traditional and link analysis to identify loans that posed the greatest risk of fraud. Link
analysis is a type of review which seeks to find relationships between two sets of data. In this review, the SBA OIG was able
to determine the vectors or indicators most strongly associated with fraud in these programs.

Figure 3. Summary of potentially fraudulent
COVID-19 EIDLs by fraud indicator

125

The SBA OIG found that the categories most correlated with fraud were the applications from Foreign or repeated
IP addresses and applications where the bank account information was used multiple times, changed, or inconsistent across
documentation. In total the SBA OIG identified 11 key fraud indicators in the COVID EIDL (and PPP) Program.126
119
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-17, SBA’s Handling of Identity Theft in the COVID-19 Economic In-
jury Disaster Loan Program, 2 (Sep. 12, 2022); U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic
EIDL and PPP Loan Fraud Landscape, 12 (Jun. 27, 2023).
120
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-17, SBA’s Handling of Identity Theft in the COVID-19 Economic
Injury Disaster Loan Program, 2 (Sep. 12, 2022).
121
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 21-02, Inspection of Small Business Admonition’s Initial Disaster Assis-
tance Response to the Coronavirus Pandemic, 16 (Oct. 28, 2020).
122
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 24-18, Evaluation of COVID-19 Economic Injury Disaster Loan Appli-
cants on the U.S. Department of the Treasury’s Do Not Pay List (Jun. 4, 2024).
123
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 22-06, COVID-19 Economic Injury Disaster Loan Program Recipients
on the U.S. Department of the Treasury’s Do Not Pay List (Nov. 30, 2024).
124
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 24-18, Evaluation of COVID-19 Economic Injury Disaster Loan Appli-
cants on the U.S. Department of the Treasury’s Do Not Pay List, 12 (Jun. 4, 2024).
125
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 11
(Jun. 27, 2023).
126
Id. at 10.

21
Figure 4. Fraud indicators

127

Nearly every fraud indicator identified by the SBA OIG in this report could be substantially mitigated or eliminated
by creating a robust, properly enforced control environment. Further, nearly $34 billion in fraud is related to improperly
cleared or overlooked hold codes. This management issue could be resolved with better controls, more consistent guidance
from agency leadership, and by having more contact with the borrowers. Lawmakers should leverage these findings in order
to make similar programs in the future more fraud resistant.

Additionally, the SBA OIG found that even after the SBA put in place additional controls, the controls it made were
not always effective. The SBA OIG found, admittedly in a non-statistically significant sample, that prior to the implementation
of the tax transcript requirement, controls were ineffective for approximately 55 percent for all loans issued to businesses
with inconclusive start dates; while after the tax transcript requirement and associated controls were implemented, around
40 percent of suspect loans were still approved.128 While this is an improvement, controls failing at such a high rate suggests
that the SBA lacks the requisite expertise to create a robust control environment.

The SBA’s weak control environment is tied to the SBA’s failure to complete a fraud risk assessment of the COVID
EIDL program until August 2023 (notably, after the SBA created its fraud estimate of the COVID Lending programs),
despite GAO advising this review in March 2021.129 Failing to assess the risks of this program resulted in the SBA designing
inadequate controls and constitutes a serious failure in management. Early in the pandemic, the SBA lacked the manpower,
resources, time, and expertise to conduct such an assessment; what is more concerning is the SBA’s continued failure to
perform such a study until months after being directed to by GAO.130 While certain factors explain why the SBA reduced
controls and removed policies, especially early in the pandemic, only incompetence or negligence can explain why this
review was not conducted sooner.

127
Id.
128U.S.
Small Bus. Admin., Office of Inspector Gen., Rep. 22-22, Follow-up inspection of SBA’s internal Controls to Prevent
COVID-19 EIDLS to Ineligible Applicants, 4-5 (Sep. 29, 2022).
129
Courtney LaFountain, Gov.Accountability Off., GAO-24-107395, Small BusinessAdministration: Progress and Work Remain-
ing to Implement Key Management Improvements, 10 (Mar. 6, 2024).
130
William B. Shear, Gov. Accountability Off., GAO-21-472T, Actions Needed to Improve COVID-19 Loans’ Internal Controls
and Reduce Their Susceptibility to Fraud, 5 (Mar. 24, 2021).

22
Due to the overprioritizing of speed in the early phases of the pandemic, paired with a lack of manpower and
knowledge to ensure that the SBA and its contractors implemented effective controls, the SBA maintained a persistently
weak control environment within the COVID EIDL program that was exacerbated by the minimal information included in
self-certifications. Notably, the PPP Program had substantially lower rates of fraud, which is likely partially attributable to
the private sector’s control environments. Banks are frequently and rigorously assessed on their controls, and they pay large
sums to specialists and consultants who improve and validate their control environments.131 This, paired with banks having
more experience in issuing loans at such velocity, likely contributed to COVID EIDL’s disproportionately high fraud rate
when compared to the PPP program.

5. The SBA’s Capacity
At the outset of the COVID-19 Pandemic, the SBA had fewer than 5,000 employees.132 The SBA was then given
a substantial amount of money and was told to lend it out to millions of businesses in an abnormally short time frame. The
main issue with this is that the SBA was too small to be able to quickly scale up to the requisite size needed to effectively
lend out hundreds of billions of dollars while mitigating fraud risk. In fact, the SBA OIG warned of this issue in its April 3,
2020 Report, noting that, historically, the SBA has lacked enough experienced or well-trained staff.133

In the days after Congress passed the initial COVID Relief legislation, SBA employees worked night and day to
craft the rules and policies for its new lending programs. After just a handful of days the SBA inaugurated these programs,
and in the first 14 days of these programs issued more money than the SBA had in the previous 14 years combined.134 SBA
staff did a remarkable job in quickly setting up these programs in such a short time frame, but under the circumstances, these
SBA employees did not have adequate support, staff, or time to design these programs to be fraud resistant.

Despite the SBA’s attempts to onboard employees quickly and leverage contractors to assist with their work, the
agency was far too small and under resourced at the outset to be able to rapidly scale up its lending, hiring, and servicing
efforts by orders of magnitude simultaneously while still crafting effective programs. While the SBA used the funding
provided in these programs to build out its capacity and pay contractors, many of the consequential decisions in this program
were made before the SBA was able to grow and attain expertise.

While the contractors reduced the need for the SBA to scale up internal headcount and provided immediate
expertise on these issues, the SBA’s oversight of these contractors was not consistent. The SBA OIG has indicated that
these contractors were responsible for numerous faults which increased the amount of fraud in the COVID EIDL program.
While better oversight of contractors could mitigate this issue, the SBA’s lack of capacity meant that it was not capable of
performing sufficient oversight.

Over the course of these programs, the SBA took multiple actions to expand its capacity. It reorganized its staff so
that COVID EIDL loans were handled by the Office of Capital Access, instead of the Office of Disaster Assistance. This
provided more lending expertise to the program. The SBA also purchased a facility to house its COVID EIDL servicing
operation.135 Further, the SBA hired and repositioned staff to service these loans.

Given the crunched timeframe for implementing the PPP Program and COVID EIDL programs, and the SBA’s
minimal resources, it is unsurprising that certain aspects of the COVID EIDL program would appear to be imperfectly
designed. If speed and expedience were the goals of these or future programs, larger, more well-resourced agencies should
be tasked with administering them, instead of agencies which would need to undertake massive hiring efforts. Under these
circumstances, the SBA could serve more of a subject-matter expert role, which better fits its size, purpose, and experience.

131
Ryan Tracy, Stress Test Inc.: Billions of Dollars, Bank Consultants to Manage Other Consultants, Wall Street Journal (Jun. 28,
2016).
132
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandem-
ic, 4 (Sep. 14, 2023).
133U.S.
Small Bus. Admin., Office of Inspector Gen., Rep. 20-12, Risk Awareness and Lessons Learned From Audit and Inspections of
Economic Injury Disaster Loans and Other Disaster Lending (Apr. 3, 2020).
134
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun.
27, 2023).
135
Letter from George Holman, Associate Administrator, U.S. Small Bus. Admin. Office of Cong. and Leg. Affairs, to Roger Williams,
Chairman, H. Comm. on Small Bus., 2 (May 22, 2024).

23
Additionally, making small agencies responsible for these large programs increases waste. As noted, to service
these loans, the SBA invested in a new facility. Over the course of the next 30 years, as COVID EIDL loans are being
paid off, this facility will start winding down. In doing so, the taxpayers expended substantial sums to secure a facility
that will one day become meaningless to the SBA, unless a similar disaster occurs in that period.136 Moreover, given the
challenging timeframes, the SBA felt compelled to retain contractors without engaging in a competitive process and with
little consideration for cost effectiveness.137 In future emergencies, it would be wise to consider the current capacity of the
agency responsible for handling the programs, and minimize the need to rapidly scale up, if they need to scale up at all.

A. Contractors

Given its limited capacity, the SBA was forced to use a substantial number of contractors to help implement the
COVID EIDL program, including underwriting and loan processing responsibilities.138 The SBA’s primary contractor, and
its subcontractors, would assess loan applications and provide the SBA with recommendations on whether to award funding.
SBA personnel would then review these loans and recommendations and decide whether to fund them. The following
flowchart describes how the SBA and its contractor divided responsibilities:

Figure 5. Flowchart of the Major Steps in SBA’s and Subcontractor
Number 2’s Process.

139

The SBA OIG found numerous errors in the contractor’s processing of applications. Specifically, the systems
designed by the SBA and the contractor were insufficient to identify a number of application errors that it and the SBA
agreed would warrant additional scrutiny. Due to the contractor and SBA failing to identify numerous concerning loans,
fraud rates increased. Specifically, the SBA OIG found that failures to adequately assess bank account information, IP
address information, and FEIN’s may have contributed to nearly $78 billion in fraudulent loans.140

In addition to the issues this contractor experienced in accepting applications, the SBA failed to adequately plan for
the takeover of its servicing obligations after the contractor accepted the applications.141 As the contract with its contractor
was expiring, the SBA OIG realized that the SBA would lose access to the data from the contractor and notified the SBA. The

136
Transcribed Interview with Jihoon Kim, Director, Small Bus. Admin, Off. of Fin. Prog. Ops, 113, 122 (Jun. 7, 2024).
137
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-10, Evaluation of SBA’s Contract for Disaster Assistance Loan
Recommendation Services (Apr. 14, 2022).
138
Given that these contractors performed a valuable service for the United States during the pandemic, the names of individual con-
tractors have been withheld throughout this report unless a final legal judgment has been made regarding their activities and liability.
139
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Report Number 21-02, Inspection of Small Business Administration’s Initial
Disaster Assistance Response to the Coronavirus Pandemic, 9 (Oct. 28, 2020).
140
Id. at 15-16.
141
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-10, Evaluation of SBA’s Contract for Disaster Assistance Loan
Recommendation Services (Apr. 14, 2022).

24
SBA then began to create a plan to transfer the data. Given the rushed time frame of these programs generally, and the SBA’s
minimal staffing, it was unable to create a plan for this data transfer in time. As a result, the SBA had to modify its contract
to allow it more time. While costing taxpayers, modifying this contract avoided the SBA’s having even more unreliable data,
which would have further increased fraud risk and deprived investigators evidence for prosecuting fraudsters.

The SBA OIG also found that the SBA often gave their contractors too much deference. Specifically, the SBA
OIG indicated that the SBA had abandoned the control environment it had designed at the start of the pandemic, and
instead allowed their contractors to utilize their in-house control environments.142 Further, the SBA OIG indicated that
there was a more widespread issue with the SBA not testing the systems and controls designed by the contractors to ensure
they worked.143 Whether due to a lack of capacity to perform such reviews, or simple mismanagement, the SBA’s lack of
oversight of its contractors contributed to fraud risk in these programs. While the SBA’s contractors deserve appreciation
for helping in a time of need, the SBA did not do a sufficient job ensuring these contractors effectively executed their work.

6. Data management
Throughout the COVID EIDL program the SBA had multiple challenges in maintaining, leveraging, and protecting
the data from this program. In fact, if a private sector bank had provided records similar to the SBA’s records to a prudential
regulator, it is likely that bank would receive a record breaking fine, if not be entirely shut down. While the SBA does not
have the same obligations as large financial institutions, it is now managing similar amounts of money. In an industry where
data retention and adequate customer support is mandated by law, the SBA’s data and records systems were and remain
woefully insufficient. Insufficient systems and data retention make fraud detection and prosecution much more difficult.

The most shocking of the data management shortcomings is the SBA’s records of their communications with
borrowers, which are woefully inaccurate. The records provided by the SBA indicate that there were entire months where
the SBA did not communicate with borrowers.144 These records also indicate that every notice of deferment ending was
sent to customers in June 2023. Obviously, this is not accurate, the SBA sent thousands of emails and letters over this
period. System issues at the SBA apparently resulted in these communications not being properly recorded. This resulted in
substantial communications being tracked to the wrong month, if they were recorded at all, making this data almost useless.
The Truth in Lending Act, as well as Regulation Z, requires financial intuitions to keep communications records; this is a
serious issue that regulators have devoted much attention to in the private sector. Since 2021, the Securities and Exchange
Commission (SEC) has issued nearly $2.5 billion in penalties to various financial institutions for failing to keep accurate
records of just a subset of communications.145

142
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Report Number 21-02, Inspection of Small Business Administration’s Initial
Disaster Assistance Response to the Coronavirus Pandemic, 9 (Oct. 28, 2020).
143
Id.
144
On file with Committee.
145
Ben Bain, Wall Street WhatsApp, Texting Fines Exceed $2.5 Billion, Bloomberg Law (Aug 8, 2023) (While many headlines on this
subject imply use of alternative messaging systems was the cause of the penalty, the SEC’s rationale for these fines is financial intu-
itions failing to retain these communications records).

25
146

While this appears to be a small issue, it is far from it. Communication records are an essential aspect of financial
regulatory compliance and bank reviews.147 The two core reasons for this is to ensure the borrowers’ rights are protected and
to mitigate certain risks.148 As noted, constant contact with borrowers is one of many strategies to reduce fraud risks.149 If
the records of this contact are lost or inaccurate, much of its utility is compromised. Additionally, borrowers have numerous
rights, including rights to be notified under certain circumstances, and the SBA’s inability to prove that these rights were
respected is unfortunate and concerning. The SBA’s records show that 513,000 emails were sent to customers who were
more than 45 days delinquent; all of these emails were sent in, or tracked to, January or June 2023. This is highly unlikely
to be accurate and displays the overall low quality of the SBA’s data tracking systems.

Additionally, the control weaknesses in the SBA’s program also resulted in it maintaining substandard data on these
programs. In addition to the findings by the SBA OIG, the independent auditor responsible for assessing the SBA’s financial
statements, KPMG, found the SBA continues to maintain substandard controls, and that these controls weaknesses resulted
in the SBA having low-quality data.150 These control failures not only allowed for additional fraud to occur, as highlighted
by the SBA OIG, but provided the SBA with substandard data which further reduced its ability to detect and prosecute fraud.

In future programs, the SBA must resolve the data weakness highlighted by its independent auditor. Additionally,
the agency should have robust data and technology best practices already established in order to avoid similar issues in
future programs.

146
SBA Total Emails by Month, U.S. Small Bus. Admin. (Feb. 1, 2024)(On file with the Committee).
147
CFPB Supervision and Examination Manuel, Consumer Fin. Protection Bureau (Mar. 18, 2022).
148
U.S. Fed. Reserve, SR 19-5, Communication Expectations for Community Bank Examinations and inspections (Mar. 7, 2019)(Su-
pervisory guidance issued to banks with under $10 billion in total assets).
149
U. S. Gov. Accountability Off., GAO-15-593SP, A Framework for Managing Fraud Risk in Emergency Assistance Programs, 41
(Jul. 2015).
150
U.S. Small Bus. Admin., Office of the Inspector Gen., Rep. 24-03, Independent Auditors’ Report on SBA’s Fiscal Year 2023 Finan-
cial Statements (Nov. 15, 2023).

26
7. The PPP Program and Anti-Industry Sentiment
Given that the PPP program was much larger in scope, it was easy to assume that a majority of the COVID fraud
would have occurred in the larger program. However, this was not the case. The SBA OIG released a report indicating that
the fraud rate for COVID EIDL was approximately four times higher than the PPP Program.

The SBA OIG’s report on fraud in these programs was issued at a time when the phrase “PPP” had become a
synonym for fraud and unearned money due to multiple high-profile fraud cases.151 Indeed, many news outlets continue to
focus on fraud within the PPP Program over the COVID EIDL program. While there were reasons to believe that the PPP
Program was worthy of more scrutiny than others, it is likely that much of the focus on the PPP Program was due to certain
biases against the SBA’s industry partners. It was easier to blame the private sector partners than to look internally at the
agency’s own material weaknesses.

As noted, during the 117th Congress, Democrats on the Select Subcommittee on the Coronavirus Crisis issued a
report discussing issues that it found in the PPP Program.152 Specifically, it highlighted four lenders in the PPP Program
that had potentially abused the PPP Program to various degrees. While all those who defraud the taxpayer should be held
accountable, the report itself appears to be a hammer in search of a nail. Instead of seeking to understand how or where
most of the fraud occurred in these programs, or how to optimize such programs going forward, it appears Congressional
Democrats were set on writing a report which would lambast FinTechs and “less regulated entities.”

To put in prospective how misguided the attention directed towards these entities was, assuming the Select
Subcommittee’s most extreme estimate of how much fraud originated from less regulated entities is correct, the value of this
fraud is less than just the value of fraud in the COVID EIDL program which came from suspect IP addresses. Additionally,
at the time of the Select Subcommittee’s report, these entities were already under investigation by the SBA OIG and law
enforcement, making these efforts duplicative.

It is likely that this misplaced focus by Congressional Democrats, and their surrogates in the media, obscured the
realities of fraud in these programs, at least to some degree. While there should be investigations to ensure private companies
are following the rules, Members of Congress and their staff should be careful to direct their efforts toward oversight that is
beneficial to the American people, and not just part of a broader messaging push against an emerging industry.

8. COVID EIDL Conclusions
In sum, the COVID EIDL program was fundamentally flawed in its design, poorly managed, and highly susceptible
to fraud. The legislation authorizing this program was not well tailored to reducing fraud risks at such a scale, and in many
cases was directly responsible for fraud that occurred. The SBA was not in a position to manage such a large program at the
start of the pandemic and struggled to address programmatic needs at every stage of the process. Future emergency relief
programs should not be modeled after the COVID EIDL program. Further, future emergency lending programs should be
tailored to the exact needs of the public based on the specifics of the emergency (such as whether relief could be issued
over time), robust controls should be maintained by the agencies and their partners for all lending, and lawmakers should
consider programmatic structures which minimize risk and disincentivize fraud.

151
Ken Dilanian & Laura Strickler, Biggest Fraud in a Generation The Looting of the COVID Relief Plan Known as PPP, NBC News
(Mar. 28, 2022).
152
U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facilitated Fraud in the Pay-
check Protection Program, 13 (Dec. 2022).

27
IV. Fraud Within the PPP
1. Introduction
The PPP Program is likely the most well-known of the SBA’s Pandemic Relief Programs, and it was by far the
largest. In total the PPP Program issued over $800 billion in loans eligible for forgiveness if the borrower satisfied the
requisite criteria.153 Despite widespread reports of fraud in this program, the PPP Program had a fraud rate substantially
lower than the COVID EIDL program. In total the SBA OIG estimates that approximately $64 billion from this program
was issued to fraudsters; compared to its total funding, this results in a fraud rate of approximately eight percent.154 While
the SBA made its alternative estimate of fraud across these programs, for reasons similar to COVID EIDL, and because the
SBA OIG’s findings more closely resembling findings from Bloomberg, Equifax, and other outlets, the SBA OIG’s estimate
is more likely to be correct.155

The PPP Program relied on a network of lenders who partnered with the SBA to issue loans. In total, over 5,000
entities partnered with the SBA for the PPP Program.156 Lenders would issue and service these loans until maturity, or until
the borrower submitted their forgiveness application, which included documentation regarding how the PPP Program funds
were used.157 The SBA would purchase the loan from the lender and review the application to determine whether to forgive
the loan or reduce the amount of forgiveness depending on the borrowers compliance with the terms of the program. In cases
where ineligible recipients were issued loans, the SBA would still purchase the loan from the lender but require the lender
return the fee paid by the SBA for the lender to issue the loan.158

While the COVID EIDL program was substantially more challenged, the PPP Program also experienced an
unacceptable amount of fraud and abuse. In theory, the PPP Program was a more attractive option for fraudsters. They could
get basically free money, provided they could produce enough fake or forged documentation. These fraudsters’ efforts were
buoyed by the SBA’s multiple system and control issues, and constantly changing guidelines, which allowed billions of
dollars’ worth of inaccurate documentation to be submitted and approved for guaranteed purchase. The PPP Program would
need substantial changes to be made into an effective program in the future.

2. Programmatic Structure
The PPP Program shared some of the same structural issues as COVID EIDL, but in a far less extreme manner. Given
the banks’ more robust controls, the PPP Program was also far better managed overall than the COVID EIDL program. Still,
numerous aspects of the PPP Program’s structure were not well suited to mitigating fraud risks.

A. Lump Sum Payments

Just the same as the COVID EIDL program, the PPP Program provided the entirety of the loan funds up front but
withheld the maximum benefit until a later point. Withholding loan forgiveness until a future date that is less burdened by
the business’s pressing need for cash allows enough time for the borrower to be able to provide business documents and
prove their eligibility for forgiveness. Further it is another touchpoint with the borrower that aids in the identification of
fraud.

153
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 11
(Jun. 27, 2023).
154
Id. at 23.
155
Ken Dilanian & Laura Strickler, Biggest Fraud in a Generation: The Looting of the COVID relief Plan Known as PPP, NBC News
(Mar. 28, 2022); See also U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facili-
tated Fraud in the Paycheck Protection Program, 13 (Dec. 2022) (Wherein, despite the fact that widespread fraud was occurring in
PPP and COVID EIDL, Democrats in Congress hyper-focus on just a few lenders).
156
Paycheck Protection program Report: Approvals through 05/31/2021, U.S. Small Bus. Admin. (Jun. 1, 2021).
157
Paycheck Protection Program First Draw Loans, U.S. Dept. of Treasury (Jan. 8, 2021).
158
U.S. Small Bus. Admin., SBA Procedural Notice 5000-812316, PPP Guaranty Purchase Charge-Off and Lender Servicing Respon-
sibilities (Jul. 21, 2021).

28
Conversely, by providing all of its funds up front, fraudsters that planned to disappear with the loan funds, usually
by providing information on their applications that they believe could not be traced back to them, were not sufficiently
discouraged. This means that the PPP Program’s structure was more resistant to types of fraud such as identity theft and
material misrepresentations but was as susceptible as COVID EIDL to those fraudsters that simply sought to abscond with
loan funds.

As with COVID EIDL, the need for rapid dispersal of funds only existed in the earliest days of the pandemic.
Conceivably, borrower’s needs could still be met through a system which rapidly dispersed smaller amounts of funds
immediately and then required more robust reviews for future borrowing. This would better meet the combined goals of
reducing fraud while getting the funds out expeditiously. Alternatively, if lawmakers believe that multiple or installment
payments pose too great a technical challenge in such a large program, or will be too inefficient, law makers should consider
requiring, at the very least, higher risk loans to be issued in multiple payments.

B. Moral Hazard

The structure of the PPP Program also induces a degree of moral hazard. Since the SBA guarantees these loans,
some lenders believed they were exposed to little downside risk in approving suspect applications. While the SBA could
demand lenders repay the fee they received for issuing the loan, some lenders may not have been sufficiently discouraged
by this, and believed the SBA’s guarantee purchase of these loans protected them from risky behavior. Overall, the number
of lenders which abused the program and substantially reduced controls was relatively few, but these few lenders may have
been responsible for substantial amounts of fraud in the PPP program going undetected.

As reported by the House Select Subcommittee on the Coronavirus Crisis, it is possible, though speculative, that
just a few FinTech firms represent a large portion of fraud in this program.159 A small number of FinTech firms did not have
adequate controls to detect and prevent fraudulent applications. In fact, the Select Subcommittee found numerous emails
from executives at these companies which indicate that company executives sought to shift the fraud risk onto the SBA.160
These firms’ lack of expertise, combined with the incentives of the program, which paid lenders based on the number of
loans they issued, resulted in an appreciable amount of fraud originating from these firms.

Counter to the Select Subcommittee’s implications, the overall takeaway from this is not that FinTechs are inherently
suspect and that “under regulated entities” should be avoided or treated differently in public-private partnerships.161 While
this issue was found in a few FinTech companies, 21 FinTech firms and an additional 190 other “under regulated entities,”
were partnered with SBA for the PPP Program.162 Overall, these firms provided a valuable service at generally lower risk to
the taxpayer than the SBA’s COVID EIDL program. While the FinTech firms that abused the system should be investigated
and punished according to the law, the essential takeaway is that the SBA simply must be more diligent in selecting and
overseeing its partners. Further, while care should be taken when dealing with emerging industries, such as the FinTech
industry, the United States should foster a business environment that supports entrepreneurship and innovation.

Additionally, the SBA should have been aware of the issues at these FinTech firms. The SBA OIG found that one
firm increased its loan volume from 200 loans per year to 500,000 at the start of the PPP Program.163 This exponential
change is notable and should have been quickly flagged by the SBA at the time. Additionally, if the SBA detects such a large
increase in loan volume from one lender, it should automatically consider the need to scrutinize loans from this lender more
in the future. While obvious, for decades the SBA OIG has been indicating that the SBA needs to improve its oversight of
partners and contractors, and such improvements have not occurred.164

In comparison to COVID EIDL, the financial institutions in the PPP Program, especially the traditional lenders, had

159
U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facilitated Fraud in the Pay-
check Protection Program (Dec. 2022).
160
U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facilitated Fraud in the Pay-
check Protection Program (Dec. 2022).
161
Id.
162
Paycheck Protection program Report: Approvals through 06/31/2021, U.S. Small Bus. Admin. (Jul. 1, 2021).
163
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 11
(Jun. 27, 2023) (SBA OIG provided verbal confirmation to the Committee that the entity referenced in this report was a FinTech firm).
164
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 20-13, White Paper: Wisk Awareness and Lessons Learned From Prior
Audits of Entrepreneurial Development Programs, 4 (Jun. 27, 2023).

29
far greater incentive to be risk conscious when issuing loans. While insulated from some risk, these financial institutions
would also still bear some cost for the loss in the form of a fee. In comparison, the SBA’s only incentive to reduce fraud is
reputational, with all of its financial risk deferred to taxpayers. For this reason, government direct lending programs will
always have less direct incentive to reduce fraud risk than businesses whose existence is threatened by issuing bad loans.

3. Control Environment
The SBA’s controls within the PPP Program were insufficient to detect and prevent fraud. Unlike COVID EIDL, a
large portion of the PPP Program relied on lending controls outside of the SBA’s purview. Specifically, while bank’s loan
eligibility criteria were reduced to facilitate lending, they were not required to remove or reduce their lending controls related
to fraud prevention. These controls aided in the identification and prevention of fraud to a greater extent than the SBA and
its contractors in the COVID EIDL program. Despite its reduced responsibility in this program, the SBA had a responsibility
to review loan forgiveness applications on the backend to ensure that suspect loans were not written off. Unfortunately, the
SBA still lacked sufficient controls for determining whether a borrower was eligible for forgiveness.

As with the COVID EIDL program, the PPP Program failed to have adequate controls in place to prevent loans being
issued to individuals on Treasury’s DNP list. This resulted in at least $3.6 billion worth of loans being issued to individuals
on Treasury’s DNP list.165 Thanks to the structure of the PPP Program, the SBA had an opportunity to assess these loans
again at loan forgiveness to detect this. Unfortunately, the SBA OIG indicated that the SBA was not able to implement
sufficient controls on the back end, meaning that still $1.4 billion in loans could have been issued to fraudulent recipients.166

The SBA also lacked sufficient controls for duplicative loan applications.167 Specifically, the SBA OIG found that
SBA’s controls were not sufficient to identify all borrowers who had already applied for a loan at a different financial
institution. In total, the SBA OIG estimates that nearly $1 billion was issued to duplicative recipients.168

Additionally, Congress increased the funding to the PPP Program with the Paycheck Protection Program and Health
Care Enhancement Act. This increase in funding resulted in a backlog of applications for the SBA to review. To address
this backlog, the SBA relaxed its controls related to validating employee count. This resulted in at least $4 billion going to
entities that did not have valid employee counts listed on their applications.169

The weak control environment within the SBA allowed numerous fraudulent loans to be issued and, perhaps,
forgiven. Further, the SBA’s failure to maintain sufficient controls harmed its underlying data ecosystem and the usability
of its data. By failing to implement effective controls on its forgiveness decisions, partially due to inadequate data, the SBA
allowed more fraud to go undetected.

4. Management Challenges
In addition to the more inherent issues the PPP Program faced related to structure and implementation, a number
of decisions by the SBA in its management of this program greatly increased the difficulty of identifying and recollecting
fraudulently lent funds. The majority of the SBA’s mismanagement in the program could have been entirely avoided. As
with most of the problems with the PPP Program, these issues were far less impactful than similar issues in the COVID
EIDL program.

165
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 24-06, SBA’s Eligibility and Forgiveness Reviews of PPP Loans Made
to Borrowers with Treasury’s Do Not Pay Data Matches, 3 (Jun. 4, 2024).
166
Id. at 4.
167
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 21-09, Flash Report: Duplicate Loans Made Under the Paycheck pro-
tection Program (Mar. 15, 2021).
168
Id. at 2.
169
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 21-07, Inspection of SBA’s Implementation of the Paycheck Protection
Program, 10 (Jun. 4, 2024).

30
A. Data

The SBA also struggled to maintain consistent and accurate data from PPP lenders. Data and Information Technology
(IT) problems, especially in relation to the SBA’s partners, have been a longstanding issue within the SBA.170 The SBA OIG
found that the SBA was unable to attain reliable and consistent data from its partnered financial institutions.171 Further, the
SBA maintained inadequate data systems for recording PPP loan forgiveness decisions.172

The first of these major issues was the SBA’s failure to issue clear guidance to inform lenders on what data the SBA
needed from the banks.173 This resulted in a number of applicants’ information being passed from the banks to the SBA that
were missing important information, most notably, employee count. This resulted in the SBA having a reduced capacity
to detect fraud and improper payments to businesses that surpassed that threshold. The SBA’s review processes were also
insufficient and allowed loans with missing employee count data to apply for and receive forgiveness.174 This suggests that,
while the SBA’s secondary check on applicants aided in the mitigation of fraud, its lack of data substantially hindered its
ability to perform accurate forgiveness assessments.

Additionally, the SBA’s system for tracking returned COVID Funds from the PPP Program was described a
“informal, [and] ad hock” by the SBA OIG.175 Failing to maintain adequate data systems will inevitably allow more fraud to
go undetected. Further, the forgiveness applications provided a valuable opportunity to assess PPP borrowers and whether
they may have committed fraud. By failing to have adequate tracking data, the SBA made tracking this fraud more difficult.

B. Lender Guidance

The SBA was also repeatedly warned that it needed to improve the guidance it was providing to lenders at various
stages in the process.176 To that end, even continuing through 2024, the Committee has received outreach from lenders that
they are receiving insufficient support and guidance on certain PPP loans. Additionally, these lenders have stated that SBA’s
expectations from lenders when submitting guarantee purchase applications are inconsistent.

The SBA OIG identified a number of subjects in the program for which it would be important for the SBA to issue
guidance. This included guidance on loan eligibility and guidance on how to submit guarantee purchase applications; these
aspects of the PPP Program were the core differences between PPP and the traditional 7(a) loan program. The SBA OIG also
found that the SBA did not provide lenders comprehensive guidance on how to handle fraudulent loans.177

Specifically, the SBA OIG indicated that the SBA needed to advise lenders on how to recover fraudulently obtained
funds, handle seized funds, return remaining funds, handle deposits from potentially fraudulent loans, and handle the
remaining unspent funds from a fraudulent PPP loan.178 The SBA OIG first noted this issue in May 2022, and despite having
ample time, the SBA had failed to issue sufficient guidance as of May 2023. Given that lenders still face a tremendous
amount of uncertainty regarding how they should treat potentially fraudulent loans, its is highly likely that this contributed
to an increased rate of fraud in these programs. Lenders lacking the tools and information from the SBA will not only

170
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-01, Top Management and Performance Challenges Facing the Small
Business Administration in FY 2023, 16 (Oct. 14, 2022).
171
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 22-13, SBA’s Handling of Potentially Fraudulent Paycheck Protection
Program Loans (May 26, 2022); U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-01, Top Management and Performance
Challenges Facing the Small Business Administration in FY 2023, 16 (Oct. 14, 2022).
172
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 7
(Jun. 27, 2023).
173
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-01, Top Management and Performance Challenges Facing the Small
Business Administration in FY 2023, 18 (Oct. 14, 2022).
174
U.S. Small Bus. Admin. Off. Of the Inspector Gen., Rep. 21-07, Inspection of SBA’s Implementation of the Paycheck Protection
Program, 6 (Jun. 4, 2024).
175
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, 7
(Jun. 27, 2023).
176
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-01, Top Management and Performance Challenges Facing the Small
Business Administration in FY 2023, 18 (Oct. 14, 2022).
177
Id. at 18.
178
Id.

31
mishandle these loans; the various lenders are likely to take different approaches to the issue. This will result in additional
confusing, messy data in this program, further muddling fraud detection efforts.

C. Partner Oversight

As in the COVID EIDL program, the SBA’s oversight of its partners in the PPP Program had weaknesses that
increased fraud risks. As noted, the SBA oversight of its partnered financial institutions allowed a small number of lenders to
potentially abuse the program, with little resistance from the SBA. This abuse was not covert; the lenders at issue increased
their lending volume by orders of magnitude, yet this issue went mostly unaddressed by the SBA.179

Additionally, the SBA OIG identified numerous other areas’ where the SBA conducted insufficient oversight of
its lending partners. This includes failing to ensure that lenders complied with certain federal laws related to the required
communications with borrowers. The SBA OIG found that the SBA did not ensure that lenders actually discussed with
borrowers their business’s status, notified the borrower that payment was due, nor send demand letters after the loan was
more than 60-days past due.180

Related to its failure to implement controls to this effect, the SBA also conducted insufficient oversight of its
partners relating to duplicate loans. In the PPP Program, the SBA was responsible for coordinating across lenders; this
includes ensuring that borrowers are not getting multiple PPP loans from different banks. Over the course of the pandemic,
the SBA did not adequately assess whether lenders were making these duplicative loans.181 This provided fraudsters with the
ability to secure even more funds from various banks.

Contact between borrowers and lenders in this program, and therefore its impact on risk mitigation, was largely
dependent on which financial institution issued the loan. While concrete conclusions are therefore difficult to make,
constituent outreach to the Committee regarding these loans has displayed far more consistent and reliable contact between
borrowers and financial institutions than borrowers and the SBA in the COVID EIDL program. Simultaneously, the SBA’s
failure to oversee partnered lenders communications with borrowers is highly concerning.

D. Treasury and Credit Bureau Reporting

While the SBA’s decision to end collections on delinquent loans will receive its own report, it also had an impact
on fraud rates in the PPP Program. A substantial amount of these delinquent loans were charged off by the SBA during this
period, but the SBA failed to report these charged off debts to credit reporting bureaus.182 As a matter of practice, the SBA
generally reports to the major three credit rating agencies, providing monthly updates to one of the agencies, and quarterly
updates to the other two.

In just the second half of 2022, the SBA failed to report over $2 billion in delinquent loans to the credit rating agency
it updates monthly.183 This constitutes up to 97 percent of SBA’s charged off loans not being reported. Further, the SBA OIG
found that the SBA only reported 38 percent of charged off loans to the other two agencies.184

Failing to report these debts removes one of the few aspects of this program which would induce compliance and
discourage fraudsters- the impacts to a borrower or fraudsters credit. Not only does active credit reporting help reduce
fraud risks by ensuring borrowers are trustworthy, it also serves as one of the few points of leverage the government has in
179
U.S. H. Select Subcomm. on the Coronavirus Crisis, We Are Not the Fraud Police: How Fintech Facilitated Fraud in the Pay-
check Protection Program (Dec. 2022); See also U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-09, COVID-19 Pandem-
ic EIDL and PPP Loan Fraud Landscape, 6 (Jun. 27, 2023).
180
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-20, SBA’s Guaranty Purchases for Paycheck Protection program
loans, 10 (Jul. 9, 2024).
181
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 21-09, Flash Report: Duplicate Loans Made Under the Paycheck Pro-
tection Program (Mar. 15, 2021).
182
See generally U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-20, SBA’s Guaranty Purchases for Paycheck Protec-
tion program loans (Jul. 9, 2024).
183
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-20, SBA’s Guaranty Purchases for Paycheck Protection program
loans, 4 (Jul. 9, 2024).
184
Id. at 5.

32
reclaiming these funds. Borrowers that avoid credit reporting and have their loan charged off suffer very little consequence
for failing to pay their loan. This is doubly true for fraudsters, who may avoid detection due to shoddy credit reporting.
Additionally, identity theft was a major means of committing fraud in this program; failing to report to credit agencies could
reduce fraud detection, as the individual whose identity was stolen would not be alerted by the credit report.

It is also likely that such mistakes being publicly known can induce additional fraud in future programs. If criminals
are of the belief that they would avoid potentially all consequences, they are likely to not be sufficiently discouraged from
committing fraud. The SBA should take active measures to resolve credit reporting issues and implement systems in the
future to ensure active and accurate credit reporting is performed.185

5. The PPP Program Conclusion
Overall, the PPP Program was better managed and more fiscally responsible than the COVID EIDL program.186
Overall, the program represented a relatively viable public-private partnership where lenders quickly, and more effectively
than the government, rendered government aid to needy businesses. Its reliance on banks and their existing infrastructure
leveraged existing resources that the SBA lacked. Additionally, the financial institution’s experience and expertise made
the PPP Program far more robust than the COVID EIDL program. Despite its relative success, the PPP Program would still
require substantial changes to be a viable model for future emergency relief programs.

185
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-20, SBA’s Guaranty Purchases for Paycheck Protection program
loans, 11 (Jul. 9, 2024).
186
Other questions of this program’s utility, such as its targeting adequacy, are outside the scope of this report.

33
V. Fraud Within the RRF and the SVOG Programs
In contrast to the PPP and COVID EIDL programs, the RRF and SVOG programs were far smaller. While there
is reason to believe these programs fared better than the PPP Program and COVID EIDL programs, the extent of fraud in
these programs is still unclear. Unlike PPP and COVID EIDL, the SBA OIG has not made a finding as to the total fraud rate
in these programs. The SBA itself claims that the fraud rates for RRF and SVOG were 0.75 and 0.33 percent, respectively.
While these estimates are the only baseline presently available, it is likely that the SBA drastically underestimated fraud in
these programs, as it did with the PPP and COVID EIDL programs.

The RRF and SVOG Programs were created later in the Pandemic and did not open to receive applications until
2021.187 While far less analysis and review has been conducted on these portfolios, these programs appear to be slightly
more fraud resistant than both the PPP Program and COVID EIDL programs, partially because grants involve more active
maintenance and because more robust controls were in place. This is largely a product of the lessons the SBA learned in
the PPP Program, the nature of grants, and the SBA having substantially more time to develop both programs. Conversely,
while the SBA had additional time to implement these programs, both took substantially more time to start distributing
funds than with the PPP Program or COVID EIDL programs.188 In fact, the SBA OIG criticized the SBA for the SBA’s slow
implementation of these programs, in contrast to PPP and COVID EIDL programs, which the SBA OIG praised for initiating
so quickly while acknowledging the fraud that resulted as a consequence.

1. Fraud in the RRF Program
While the fraud rate in the RRF program is estimated by the SBA to be only 0.75 percent, findings from SBA OIG
suggest that this estimate is likely overly optimistic. While the SBA OIG has not released its own estimate, it has found that
billions of dollars of loans went to improper and potentially fraudulent recipients. Specifically, the SBA OIG found that the
RRF program provided $3.5 billion in funds to borrowers who have not filed the reports required under this program.189 That
$3.5 billion represents over 12 percent of the funds in this program. While a portion of these grantees are not fraudsters, and
likely simply forgot to file these reports, this behavior is also indicative of potential fraud.190

Similar to the PPP Program and COVID EIDL program, the SBA also struggled with effectively managing its
partners in this program. The SBA OIG found that the nearly 4,000 applications were submitted through a partner who failed
to verify gross sales of grantees.191 These applications equated to over $278 million, of which the SBA OIG labeled $20
million as potentially fraudulent.192

If the SBA OIG’s findings are representative of this portfolio in its entirety, it is possible that these combined
issues resulted in the RRF program having a fraud rate similar to that of PPP. As a potential model for future disaster relief
programs, the RRF had a number of challenges which could likely be overcome in future emergencies but were improperly
addressed during the COVID-19 Pandemic.

2. Fraud in the SVOG Program
The SBA estimates that just 0.33 percent of the money it granted in the SVOG program went to fraudulent recipients.
Like the RRF, the SBA’s estimate likely underestimates substantial amounts of fraud in these programs. While having more
187
Cong. Research Serv., IF11819, SBA Restaurant Revitalization Fund Grants (Aug. 15, 2022); About SVOG, U.S. Small Bus.
Admin. (Last visited Aug. 12, 2024).
188
See generally U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-15, SBA’s Oversight of Restaurant Revitalization Fund
Recipients (Sep. 29, 2023); See generally See generally U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-10, SBA’s Admin-
istrative Process to Adress Potentially Fraudulent Restaurant Revitalization Fund Awards (Jul. 5, 2023).
189
U.S. Small Bus. Admin., Protecting the Integrity of the Pandemic Relief Programs (Jun. 27, 2023).
190
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-15, SBA’s Oversight of Restaurant Revitalization Fund Recipients
(Sep. 29, 2023).
191
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 23-10, SBA’s Administrative Process to Adress Potentially Fraudulent
Restaurant Revitalization Fund Awards, 4 (Jul. 5, 2023).
192
Id. at 5.

34
time to establish this program and create its rules and structure, the SBA OIG found that the SBA did not actually implement
its planned structure for issuing these grants.

For example, as a fraud mitigation strategy, the SBA planned to issue payments to high-risk grantees in the SVOG
program over time, instead of a single advance payment. While a valuable mitigation strategy, indeed one recommended
by this Committee in this report for other programs, the SBA simply failed to follow through on this strategy.193 While
other factors sufficiently reduced fraud risks in this program enough to avoid creating a major issue, management failing to
implement this strategy likely allowed for fraud to occur in an otherwise fraud-resistant program.

Further, the SBA’s policies required that grant reviewers spend less than four hours reviewing a grant for eligibility,
and that supervisors spend less than 30 minutes approving the grant review also increased fraud risks. While a potentially
reasonable framework, this ignored the reality that 97 percent of SVOG applicants were working with the SBA for the first
time and therefore submitted substandard quality applications.194 This resulted in SVOG applications containing numerous
issues and mistakes which, in turn, caused grant reviews to take longer. Because of this and SBA issues related to staffing
and experience, the SBA has not reviewed the overwhelming majority of SVOG loans it had planned to review.

In the SVOG program, it appears that there still exits a substantial need for oversight. In addition to not having a
reliable fraud estimate, the SVOG program had numerous other issues which undermined its productivity, such as the SBA
failing to follow their intended internal plans and controls. While flawed, initial reports suggest that this program was the
most fraud-resistant of all of the COVID Lending Programs.

3. RRF and SVOG Conclusions
In setting up these programs, the SBA spent more time to develop better controls. Further, after the first year of the
pandemic, the SBA had increased its staffing substantially.195 From the outset of the pandemic, the SBA did not have the
staff and time to develop such robust programs. After scaling-up during 2020, the SBA was substantially better position to
inaugurate these programs; lending credence to the suggestion that small agencies struggle to rapidly scale up, but once they
have, they’re more able to meet their obligations.

The lessons learned in the PPP Program and COVID EIDL programs greatly increased the SBA background
knowledge when establishing these programs. The SBA pulled heavily from the lessons it learned from the PPP Program
when designing its controls in these programs, and the controls appeared to be much better at combatting fraud. Additionally,
the statutes creating these programs required substantially more documentation than the PPP or COVID EIDL programs.196

At the same time, both the RRF and SVOG programs struggled to be implemented quickly and effectively. While
the statute authorizing the SVOG program did not require these grants be made available in a set time frame, it does require
the SBA to issue reports on its program’s activities within 60 days of the passage of the Act, suggesting that Congress
anticipated that this program would issue grants by the end of February 2021.197 Despite being given two months to establish
this program, the SBA was not able to issue SVOG grants in a timely manner. The SBA started accepting applications
starting on April 26, 2021, but did not issue its first grant until May 26, 2021, four months after this program was expected
to start issuing grants.198 This delay was so severe that on June 15, 2021, 55 Senators sent a letter to the SBA requesting that
it take action to more quickly process these grants.

Perhaps what demonstrates this best is the SBA’s internal system for reviewing loans. At the start of the pandemic,

193
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandem-
ic, 4 (Sep. 14, 2023).
194U.S.
Small Bus. Admin., Office of Inspector Gen., Rep. 24-02, SBA’s Internal Controls to Prevent Shuttered Venue Operators
Grants to Ineligible Applicants, 7 (Oct. 25, 2023).
195
Adam G. Levin, et al., Cong. Research Serv., R47694, SBA as a Vehicle for Crisis Relief Lessons From the COVID-19 Pandem-
ic, 7 (Sep. 14, 2023).
196
The effectiveness of the RRF and SVOG programs was undermined somewhat by the SBA failing to follow the strategies it de-
signed for these programs.
197
Consolidated Appropriations Act, 2021, H.R.133, 116th Cong. (2020) (Section 324).
198
U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 24-02, SBA’s Internal Controls to Prevent Shuttered Venue Operators
Grants to Ineligible Applicants, 7 (Oct. 25, 2023).

35
the SBA chose to set review priority based on the time the application was submitted for all of its programs.199 While making
sense from a fairness perspective, this does not reflect a robust or well considered fraud mitigation framework. Over the
course of the pandemic, the SBA learned from this and implemented a risk-based review approach. While it is good the
SBA reversed course on this issue, it displays how the SBA, based on its decades of prior practice, lacked the expertise to
develop robust, fraud resistant programs.

Lastly, the RRF program had serious issues outside of fraud. For example, the RRF, as implemented by the Biden-
Harris Administration, was deemed to be unconstitutional and discriminatory.200 Depriving Americans benefits on account
of their immutable characteristics, such as race, sex, or ethnicity, is an appalling decision during a national emergency, but
it is not surprising given the SBA’ preoccupation with politics and optics, which borders on rankly partisan. Exploiting an
aid program to message to Democrat’s progressive base, while perhaps not constituting the crime of fraud, is a type of fraud
that the SBA conducted upon the American people.

Overall, current estimates show a fraud rate of one percent or lower in these programs— though this is likely an under-
estimate.201 From a fraud risk mitigation perspective, this outcome can be viewed as generally positive. These programs
were too small to draw definitive conclusions regarding their efficacy, especially in relation to large programs like the PPP
Program and COVID EIDL programs, but their structures were sufficiently resistant to fraud risks to accomplish most of
their programmatic goals.

199
With the exception that RRF grants were first issued to individuals in the groups described infra.
200
Vitolo v. Guzman, 999 F.3d 353 (6th Cir. 2021).
201
U.S. Small Bus. Admin., Protecting the Integrity of the Pandemic Relief Programs (Jun. 27, 2023).

36
VI. Recommendations
Based upon this Committee’s findings, the main drivers of fraud in the Pandemic Relief Programs were: (1) self-
certification; (2) too much emphasis on speed; (3) the SBA’s weak control environment; (4) the SBA’s lack of expertise; and
(5) the SBA’s concern for optics. Given these findings, the Committee proposes a number of recommendations for future
lawmakers and the SBA.

1. Self-certification should not be used to support any government lending
program.
Put simply, self-certification causes programs to be susceptible to fraud and abuse. Any efficiency achievable
through self-certification is dwarfed by the substantial oversight and servicing burden it creates. It is likely that this was
the single issue most responsible for fraud in these programs. Not only did it allow for fraudsters to abuse the system more
easily, it exacerbated many of the internal existing issues within the SBA, thereby resulting in more fraud.

While the need to get money out quickly may require the removal of some fraud protections, self-certification is not
the correct avenue for achieving this goal. Filling out application documentation is generally not the most time-consuming
part of the loan application process. Applicants are typically able to complete traditional business loan applications with a
bank in under an hour; processing these loans is usually what takes more time.

Given the limited information the SBA was receiving on applications and self-certifications, it is unsurprising that
substantial amounts of fraud went undetected. Further, it is not clear self-certification resulted in the more rapid issuing of
loans, as opposed to this simply being a product of expedited loan reviews. It is possible that if SBA staff reviewing these
loan applications had more concrete information, the process could have been even quicker, and fraud could have been
easier to detect.

As a matter of practice, disaster loans should not be difficult or cumbersome for borrowers to receive; people in
crisis do not need more stress. That does not change the reality these are still loan programs subject to an immense degree of
fraud risk. Requiring borrowers validate their eligibility should be an essential aspect of future emergency lending programs.

2. When expedience is the primary focus, subsequent action should be required
of borrowers to validate their eligibility.
As seen in the PPP Program, requiring that businesses submit documentation to further show their loan eligibility
throughout the life of the loan reduces fraud risk. While still creating a potential pay-and-chase system and being less useful
than front-end controls, it is a far more manageable pay-and-chase system than programs without such requirements. While
borrowers are still provided a substantial up-front benefit, failing to complete forgiveness applications is one of the clearer
indicators of fraud. Further, this requirement of subsequent documentation makes potential fraudsters believe that there is
an increased chance they are detected, resulting in a lower incentive to defraud the program. It also requires the fraudster to
either create more fake documentation or undertake further actions to defraud the program.

Additionally, this does not in any way conflict with needs for expediency. As in the PPP Program, requirements
to submit documents months later do not create an immediate hardship upon already needy businesses. In this structure,
businesses are provided what they need to weather the storm but have time to fully prove their eligibility.

As a matter of policy, this structure also helps ensure that funds are used as intended. By requiring businesses to
show how they used the funds, lawmakers can better direct how those funds are used. This helps the program provide the
benefit to whom it is intended- employees, in the case of the PPP Program.

37
3. When intended to compensate for multiple months of future lost income, or
otherwise appropriate or sufficient, lump sum payments should be avoided in
future emergency lending programs.
For emergency lending programs intended to make up for weeks, months, or potentially years of lost income,
lawmakers should consider programs which issue payments over time, instead of lump sums. In addition to these payments
being lower risk, doing so would allow for lawmakers and agencies to make standards, controls, and processes more rigorous
for later payments. While potentially less efficient and increasing workloads, this would have also allowed the agency to
satisfy Congress’s goals related to expediency while still creating more fraud-resistant programs. Further, if businesses need
funds immediately, necessitating the removal of anti-fraud controls and practices, only the funds that are presently needed
should be issued with such reduced fraud protections.

Not all disasters are created the same, and the needs of the public can vary greatly depending on the specific
conditions of the disaster. To that end, it is unwise to claim that lump sum, or single advance payments, should never be
used under any circumstances. With that said, should a national emergency like COVID-19 occur again, lawmakers should
strongly consider legislation requiring payments over time, provided the implementing agency can handle the technical
challenges of doing so.

4. Internal controls at agencies should not be reduced to facilitate more rapid
lending.
Agencies should view relaxing internal controls in lending programs as a last resort. Fraud risk controls are developed
to address the risks posed by fraud, and those risks are only increased in large lending programs. However, it is inevitable
that some compromises may be needed to facilitate these programs. In these cases, agencies should first perform a rigorous
assessment of their control environment and receive input from lenders, other Federal agencies, and law enforcement before
it relaxes any controls.

5. Small Agencies should not be expected to rapidly scale-up under these
circumstances.
The SBA had to scale up substantially, more than doubling its workforce, to accommodate these lending programs;
the SBA had to undertake a large hiring effort, extensively retain contractors, and make large infrastructural investments
to fulfill its responsibilities. Not only did the SBA lack experience in managing such a large program, it lacked key tools to
effectively design a fraud-resistant program. Together, these factors all contributed to the fraud in these programs.

Following the SBA’s efforts to grow, it showed some ability to better handle programmatic risk. The RRF and
SVOG programs were more resistant to fraud than the PPP Program and COVID EIDL programs, and this is likely due to the
substantial number of additional resources available to the SBA at the time. Additionally, the SBA’s successes and failures
in managing the PPP Program greatly influenced its implementation of the RRF and SVOG programs, resulting in much
more fraud resistant programs. Further, the PPP Program’s successes compared to COVID EIDL’s suggest that institutional
knowledge in private sector firms is far greater than that of the SBA, and this experience reduced fraud risk.

When selecting an agency to manage a large lending program such as those in COVID Lending programs, lawmakers
would be wise to minimize the need for the implementing agency to scale up. While an agency could develop the capacity
to effectuate the program over time, its lack of manpower and expertise at the start of a potential program would likely be
too great a hindrance.

38
VII. Conclusion
While it is our hope that there will never be another disaster that poses similar challenges as the COVID-19
Pandemic, we must learn from the wisdom gained from this experience. By acknowledging the failures and successes,
future Americans have a better chance of addressing the challenges in setting up and managing these large emergency relief
programs.

This Committee’s findings indicate that a number of programmatic and structural changes to the COVID Lending
programs would need to be made to similar, future programs to make them more robust and ensure that benefits are targeted
better to those in need, while also minimizing fraud risk. Among these are the elimination of self-certification, improved
controls by the SBA (or other implementing agency), and increased oversight of contractors and partners. Additionally, it is
wise for future lawmakers to consider whether a small agency that needs to rapidly scale-up is the proper vehicle for these
large relief programs.

While taxpayers losing hundreds of billions of dollars is enough to make these programs worthy of scrutiny, an
underappreciated aspect of fraud in these programs is its implications for other small businesses. The SBA OIG stated quite
clearly that the “overage…could have been used to provide funding to thousands or millions more…small businesses.”202
While these programs were effective at saving some jobs and businesses during the pandemic, they would have been much
more effective had these programs been well designed and the SBA had done its job well. Further, allocating benefits
properly under this program would likely have expedited the national recovery from the pandemic, and mitigated some
of the lingering economic issues. Minimizing fraud risks not only safeguards taxpayer dollars, but it also ensures that the
programs are able to achieve their goals.

U.S. Small Bus. Admin., Office of Inspector Gen., Rep. 21-01, SBA’s Emergency EIDL Grants to Sole Proprietors and indepen-
202

dent Contractors, 7 (Oct. 7, 2021).

39
IX. Acknowledgements
In addition to all the staff who worked on this report, the House Committee on Small Business would like to thank our
interns and law clerks for their assistance.

They were:

Jon Collins, Creighton University School of Law ‘24

Alyssa Berry, George Mason University Antonin Scalia Law School ‘25

Jon Benner, Washington and Lee University ‘25

File and source

File: 2024-11-01-house-small-business-covid-19-pandemic-loan-fraud-staff-report.pdf
Size: 2,010,593 bytes
SHA-256: ee791b6d97894b207aedf1b274401c5522bf0279512754d284932005b7e16f68
Our copy: 2024-11-01-house-small-business-covid-19-pandemic-loan-fraud-staff-report.pdf
Original: smallbusiness.house.gov