Approved Disaster Assistance Loans Matching COVID-19 EIDLs and PPP Loans with Fraud Hold Codes

Summary

SBA Office of Inspector General Evaluation Report 25-03, Approved Disaster Assistance Loans Matching COVID-19 EIDLs and PPP Loans With Fraud Hold Codes, dated November 5, 2024, from Inspector General Hannibal "Mike" Ware to Administrator Isabella Casillas Guzman. The report states that SBA implemented controls that resulted in the declination of 5,625 potentially fraudulent disaster assistance loan applications, but that SBA approved 188 loans totaling $8,127,613 even though they were flagged. It states that SBA provided $3.6 billion in disaster assistance loans between March 2020 and May 2024. OIG recommended that SBA review the 187 loans that matched a related COVID-19 EIDL or PPP loan with a fraud hold code, and SBA agreed.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

U.S. SMALL BUSINESS ADMINISTRATION
OFFICE OF INSPECTOR GENERAL
Approved Disaster Assistance Loans
Matching COVID-19 EIDLs and PPP Loans
With Fraud Hold Codes
Evaluation Report
Report 25-03
November 5, 2024

Make a Difference
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s
Office of Inspector General Hotline at https://www.sba.gov/oig/hotline. You can also write to the
U.S. Small Business Administration, Office of Inspector General, 409 Third Street, SW (5th Floor),
Washington, DC 20416. In accordance with the Inspector General Act of 1978, codified as
amended at 5 U.S.C. §§ 407(b) and 420(b)(2)(B), confidentiality of a complainant’s personally
identifying information is mandatory, absent express consent by the complainant authorizing the
release of such information.
NOTICE:
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023,
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities
identified in this report have the opportunity to submit a written response for the purpose of
clarifying or providing additional context as it relates to any specific reference contained herein.
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date.
We request that any comments be no longer than two pages, Section 508 compliant, and free
from any proprietary or otherwise sensitive information. The comments may be appended to
this report and posted on our public website.

U.S. Small Business Administration
Office of Inspector General
EXECUTIVE SUMMARY
Approved Disaster Assistance Loans Matching COVID‐19 EIDLs
and PPP Loans With Fraud Hold Codes (Report 25-03)
What OIG Reviewed
This report presents the results of our
evaluation to determine whether the U.S. Small
Business Administration (SBA) approved disaster
assistance loan applications to individuals or
businesses that also had a Coronavirus Disease
2019 (COVID-19) Economic Injury Disaster Loan
(EIDL) or Paycheck Protection Program (PPP)
loan with a hold code marking the loan as
potential or confirmed fraud (referred to as
“fraud hold codes” herein).
SBA provided about $1.2 trillion in direct and
guaranteed loans to businesses impacted by the
COVID-19 pandemic through the COVID-19 EIDL
program and PPP. In our report COVID-19
Pandemic EIDL and PPP Loan Fraud Landscape
(Report 23-09), we noted rampant potential
fraud totaling over $200 billion in both
programs. Of that, SBA flagged $51 billion in
loans with fraud hold codes.
SBA simultaneously operated the disaster
assistance program, providing low-interest
disaster assistance loans to individuals and
businesses impacted by other declared natural
disasters. During and after the pandemic,
between March 2020 and May 2024, SBA
provided $3.6 billion in disaster assistance loans
(non-COVID-19 EIDLs).
In October 2022, SBA established an informal
review process in Disaster Credit Management
System (DCMS) 2.0 to match disaster assistance
loan applications to pandemic loans that
had fraud hold codes based on taxpayer
identification numbers.
In August 2023, SBA began transitioning from
DCMS 2.0 to a new system called the Unified
Lending Platform (ULP). The ULP uses fraud
detection software to review each loan
application and includes a check for pandemic
program loans with fraud hold codes.
What OIG Found
SBA implemented controls to mitigate fraud
risks in its disaster assistance loan program that
prevented the approval of loans to borrowers
who also had COVID-19 EIDLs or PPP loans with
fraud hold codes. These controls resulted in the
declination of 5,625 potentially fraudulent
disaster assistance loan applications; however,
we found SBA approved 188 loans totaling
$8,127,613 even though they were flagged.
Agency officials took action to prevent one of
these loans from being disbursed after we
brought this to their attention.
What OIG Recommended
We recommended SBA review and verify the
187 loans that matched to a related COVID-19
EIDL or PPP loan with a fraud hold code for
legitimacy and eligibility.
Agency Response
SBA agreed with our recommendation and
intends to review the 187 loans that matched
to a related COVID-19 EIDL or PPP loan with a
fraud hold code for legitimacy and eligibility.
Management’s proposed corrective actions
satisfy the recommendation.

OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
Date:
To:
From:
November 5, 2024
Isabella Casillas Guzman
Administrator
Hannibal “Mike” Ware
Inspector General
Subject:
Approved Disaster Assistance Loans Matching COVID-19 EIDLs and PPP Loans With
Fraud Hold Codes (Report 25-03)
This report represents the results of our evaluation of Approved Disaster Assistance Loans
Matching COVID-19 EIDLs and PPP Loans With Fraud Hold Codes. We considered management
comments to the draft of this report when preparing the final report. SBA management agreed
with our recommendation.
We appreciate the cooperation and courtesies provided by your staff. If you have any questions
or need additional information, please contact John Provan, Director, Disaster Assistance
Programs Group, at (817) 684-5341 or Andrea Deadwyler, Assistant Inspector General for Audits,
at (202) 205-6586.

2
409 Third St. SW, Washington, DC 20416  •  (202) 205-6586  •  Fax (202) 205-7382
cc: Dilawar Syed, Deputy Administrator, Office of the Administrator
Arthur Plews, Chief of Staff, Office of the Administrator
Isabelle James, Deputy Chief of Staff, Office of the Administrator
Therese Meers, General Counsel, Office of General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Kathryn Frost, Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Peter Meyers, Senior Advisor, Office of Capital Access
Anna Maria Calcagno, Director, Office of Program Performance, Analysis, and Evaluation,
OIG Liaison
Walter B. Hill, Jr., Chief Risk Officer, Office of Strategic Management and Enterprise
Integrity, Office of Performance, Planning, and the Chief Financial Officer
Deborah Chen, Deputy Chief Financial Officer, Office of Performance, Planning, and the
Chief Financial Officer
Katherine Aaby, Associate Administrator and Chief Financial Officer, Office of Performance,
Planning, and the Chief Financial Officer
Tonia Butler, Director, Office of Internal Controls

i
Contents
Introduction .................................................................................................................................... 1
Background ............................................................................................................................... 1
Objective ................................................................................................................................... 4
Results ............................................................................................................................................. 4
SBA Implemented Controls that Reduced the Number of Disaster Assistance Loans
with Pandemic Loan Program Fraud Indicators ..................................................................... 4
Informal Process .................................................................................................................. 5
Automated Process ............................................................................................................. 5
Recommendation ................................................................................................................ 6
Evaluation of Agency Response ....................................................................................................... 6
Summary of Actions Necessary to Close the Recommendation ............................................... 6
Figures

1
Risk Review Process ......................................................................................................... 3
Appendices

1
Scope and Methodology .............................................................................................. 1-1
2
Agency Response .......................................................................................................... 2-1

1
Introduction
This report presents the results of our evaluation to determine whether the U.S. Small Business
Administration (SBA) approved disaster assistance loan applications to businesses or individuals
that also had a related Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loan
(EIDL) or Paycheck Protection Program (PPP) loan with a fraud hold code. Disaster assistance
loan applications are related to COVID-19 EIDLs or PPP loans if an applicant’s taxpayer
identification number matched to a COVID-19 EIDL or PPP loan borrower’s taxpayer
identification number. A hold code is an identifier placed on a loan in the agency’s system.
Hold codes are not always fraud related; for example, SBA may place a hold code on a loan for
general eligibility issues. For our evaluation, we only included hold codes that indicated potential
or confirmed fraud, referred to as “fraud hold codes” herein.
Background
SBA disbursed over $387 billion in direct loans through the COVID-19 EIDL program and over
$800 billion in guaranteed loans made by third-party lenders through the PPP to provide
financial assistance to businesses impacted by the COVID-19 pandemic.
In Report 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape, we noted rampant
potential fraud totaling over $200 billion in the COVID-19 EIDL program and the PPP. Of that,
SBA flagged $51 billion of disbursed or guaranteed assistance loans with hold codes for
suspected or confirmed fraud (COVID-19 EIDLs totaling $34 billion and PPP loans totaling
$17 billion).
In addition to SBA’s efforts to help businesses affected by the COVID-19 pandemic, the agency
simultaneously operated the disaster assistance program, providing low-interest disaster
assistance loans to individuals and businesses impacted by other declared natural disasters
to support the recovery of affected communities. During and after the pandemic, between
March 2020 and May 2024, SBA provided $3.6 billion in disaster assistance loans (non-COVID-19
EIDLs).

2
To prevent providing additional disaster assistance to borrowers who had pandemic loans with
fraud indicators, SBA established an informal review process in Disaster Credit Management
System (DCMS) 2.0 to match any new disaster assistance loan applicants against the borrowers
of COVID-19 EIDLs with fraud hold codes. In October 2022, SBA loan officers began receiving
daily reports of in-process disaster assistance loan applications that matched to a COVID-19 EIDL
that had been flagged for potential fraud. The match was based on the applicant’s taxpayer
identification number. SBA stated that DCMS 2.0 did not match disaster loan applications to PPP
loans with hold codes; however, this control weakness was addressed in their new loan
application processing system, the Unified Lending Platform (ULP).
In August 2023, SBA began transferring all in-process disaster assistance loan applications from
DCMS 2.0 to the ULP in a concerted effort to improve fraud detection. This transition was
completed in January 2024, and all new disaster loan applications after that date are processed
entirely within ULP. The ULP uses fraud detection software for risk verification tasks such as
reviewing applicant identity information against various databases and an internal watchlist for
suspected identity theft. Additionally, the risk verification checks each application for related
COVID-19 EIDLs or PPP loans with fraud hold codes using the Loan Information and Reporting
Application and ETRAN, SBA’s loan servicing system.
If a disaster assistance loan application was flagged by the fraud detection software in the ULP
during the risk verification, it was routed to a Risk Review team that conducted a risk review. The
risk review was a two-level process in which flagged applications were reviewed for identity
theft and other potential fraud issues by a risk reviewer and then by a team lead. If the risk
reviewer determined there was fraud or other suspicious activity, they sent the file to manual
underwriting to be declined, canceled, or decreased. If the risk reviewer suspected identity theft,
the application was withdrawn and removed from active consideration. If the risk reviewer
identified an error in the application, such as a typo in the Social Security number, they
recommended a borrower edit to be completed by underwriting. Lastly, if the risk reviewer did
not identify any issues with the loan application, they recommended the application be
reinstated for processing. See Figure 1 for a full depiction of the risk review process.

3
Figure 1: Risk Review Process
Source: SBA OIG analysis

4
Objective
Our objective was to determine whether SBA approved disaster loan applications with related
COVID‐19 EIDLs or PPP loans with fraud hold codes.
Results
SBA implemented controls to mitigate fraud risks in its disaster assistance loan program. These
controls successfully reduced the number of approved disaster assistance loans with a related
COVID-19 EIDL or PPP loan fraud hold code since implementing the risk verification and risk
review processes. Although SBA’s fraud controls resulted in the declination of 5,625 potentially
fraudulent disaster assistance loan applications, we found SBA approved 188 disaster assistance
loans to borrowers who also had potentially fraudulent pandemic loans. SBA should review these
approved loans for eligibility and legitimacy.
SBA Implemented Controls that Reduced the Number of
Disaster Assistance Loans with Pandemic Loan Program Fraud
Indicators
The informal process in DCMS 2.0 and the automated process in the ULP declined
5,625 potentially fraudulent disaster assistance loan applications. We found that the number
of disaster assistance loan applications with fraud indicators approved by SBA decreased even
further with the implementation of the automated fraud detection software. Using the informal
process, SBA approved 5 percent of disaster assistance loan applications with fraud indicators.
Using the automated process, SBA approved less than 1 percent of disaster assistance loan
applications with fraud indicators.
Although SBA reduced the number of approved disaster assistance loans with fraud indicators,
our evaluation identified the agency approved 188 disaster assistance loans totaling
$8,127,613 to borrowers who had related COVID-19 EIDLs or PPP loans with fraud hold codes.
Prior to the system conversion, SBA relied on an informal review process to match new disaster
loan applications to COVID-19 EIDLs and PPP loans with active fraud hold codes. This process was
based on Social Security numbers or Employer Identification Numbers. SBA’s implementation of
the automated fraud detection software for new disaster loans enhanced the fraud detection
process and has resulted in more effective controls to prevent loans to potential fraudsters.

5
Informal Process
From March 2020 to December 2023, SBA declined 3,380 out of 3,554 (or 95 percent)
disaster assistance loan applications that had related pandemic loans with fraud hold codes.
In October 2022, SBA implemented an informal process to help ensure that loans were not
being approved for applicants who had pandemic loans with fraud hold codes. The remaining
174 disaster assistance loan applications (or 5 percent) totaling $7,815,700 were approved
and disbursed even though the loan applications had related active fraud hold codes. These
approvals occurred because SBA did not have a reliable process in DCMS 2.0 to check if
applicants had prior loans with fraud hold codes.
Automated Process
From September 2023 to May 2024, SBA declined 2,251 of 3,214 (or 70 percent) of disaster
assistance loan applications with related fraud hold codes when they implemented an enhanced
process using automated fraud detection software to conduct a risk verification on all disaster
assistance loan applications. At the time of our evaluation, about 938 (29 percent) of loan
applications were either in process or canceled. SBA’s Risk Review team appropriately reviewed
and cleared 11 of the loan applications. The remaining 14 loans (less than 1 percent) were
approved due to other errors.
Specifically, while SBA implemented an enhanced fraud detection process that resulted in more
effective controls to prevent loans to potential fraudsters, we found the agency approved
13 disaster assistance loan applications to borrowers who also had COVID-19 EIDLs or PPP loans
with fraud hold codes due to internal miscommunication resulting in two fraud hold codes
being excluded from the risk verification search. These two fraud hold codes have since been
reinstated, in part, due to our review and SBA’s proactive response. As of August 9, 2024, SBA
had disbursed $311,913 on these 13 loans.
We identified one additional disaster loan application that the risk reviewer recommended for
approval. The reviewer stated the related hold codes were not fraudulent even though the
related loan was part of a fraud scheme in which the perpetrator pled guilty to conspiracy to
commit wire fraud and money laundering. According to agency officials, this occurred due to a
training issue with the individual who conducted the risk review. After we brought this to SBA’s
attention, the agency stated they would take action to cancel the loan, as it had not yet been
funded. As a result, SBA declined this loan application on August 13, 2024, due to potential
fraud.

6
Recommendation
To address the risk of fraud associated with approved disaster assistance loans with related
COVID-19 EIDLs or PPP loans with fraud hold codes, we recommend the Administrator direct the
Associate Administrator for the Office of Capital Access to:
Recommendation 1: Review the 187 loans that matched to a related COVID-19 EIDL or PPP loan
with a fraud hold code for legitimacy and eligibility. If any of the 187 loans are found to be
illegitimate, ineligible, or fraudulent, take appropriate action to 1) prevent disbursement of
funds, 2) recover the funds, and 3) refer potentially fraudulent loans to OIG.
Evaluation of Agency Response
SBA management provided formal written comments that are included in their entirety in
Appendix 2. Management agreed with our recommendation to review the 187 loans that
matched to a related COVID-19 EIDL or PPP loan with a fraud hold code for legitimacy and
eligibility.
Summary of Actions Necessary to Close the Recommendation
The following section summarizes the status of our recommendation and the actions necessary
to close it.
Recommendation 1
Review the 187 loans that matched to a related COVID-19 EIDL or PPP loan with a fraud hold
code for legitimacy and eligibility. If any of the 187 loans are found to be illegitimate, ineligible,
or fraudulent, take appropriate action to 1) prevent disbursement of funds, 2) recover the funds,
and 3) refer potentially fraudulent loans to OIG.
Status: Resolved
Management agreed with our recommendation to review the 187 loans provided by OIG.
Management further stated they will take appropriate action if any of those loans are found to
be illegitimate, ineligible, or fraudulent. This recommendation can be closed when SBA provides
evidence of the appropriate action taken for the 187 loans that matched to a related COVID-19
EIDL or PPP loan with a fraud hold code.

1-1
Appendix 1: Scope and Methodology
This report presents the results of our evaluation to determine whether the U.S. Small Business
Administration (SBA) approved disaster assistance loan applications with related Coronavirus
2019 Disease (COVID-19) Economic Injury Disaster Loans (EIDL) or Paycheck Protection Program
(PPP) loans with fraud hold codes. Our scope of work covered disaster assistance loan
applications submitted from March 2020 through May 2024.
To answer our objective, we reviewed laws, regulations, policies, procedures, and guidance
pertaining to SBA’s risk review process to detect, prevent, and decline potential fraudulent
disaster assistance loan applications with related COVID-19 EIDLs and PPP loans with fraud hold
codes.
We interviewed SBA personnel from various offices in the Office of Capital Access and the Office
of Performance and Systems Management to gain an understanding of related processes,
procedures, and system controls. Additionally, we interviewed officials of the SBA contractor
tasked with monitoring the fraud software used in the Unified Lending Platform to detect
suspicious activity.
Further, we analyzed data for disaster assistance loan applications other than COVID-19 EIDLs
submitted from March 2020 to May 2024 by extracting the employer identification numbers and
Social Security numbers from this universe of data and matching those to COVID-19 EIDLs or PPP
loans with a potential fraud or confirmed fraud hold code to help identify the number of loans
with related pandemic fraud issues that were approved. The disaster application data was
retrieved from the LIRA Data Warehouse on May 2, 2024.
We conducted this inspection in accordance with the Council of the Inspectors General on
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. These standards
require that we adequately plan and perform this evaluation to obtain sufficient and appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our objective.
We believe the evidence provides a reasonable basis for our conclusions based on our objective.
Use of Computer-processed Data
We relied on data from SBA’s Loan Information and Reporting Application and the Unified
Lending Platform. We performed limited testing on data extracts to ensure the data was
complete, reliable, and met the scope parameters of this evaluation. We also performed a data

1-2
reliability assessment to ensure the data materially supports the findings, conclusions, and
recommendations. As a result, we believe the data is sufficiently reliable to support the findings
in this report.
Prior Audit Coverage
The following lists the Office of Inspector General’s previous audit coverage related to the
objective of this report:
Report
Number
Report Title
Report Date
Report 24-17
7(a) Loan Approval for Borrowers with Unresolved COVID-19
Pandemic Loan Compliance Issues
May 21, 2024
Report 23-09
COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape
June 27, 2023
Report 22-22
Follow-Up Inspection of SBA’s Internal Controls to Prevent
COVID-19 EIDLs to ineligible Applicants
September 29, 2022
Report 22-06
COVID-19 EIDL Program Recipients on the Department of
Treasury’s Do Not Pay List
November 30, 2021
Report 21-15
SBA’s Handling of Identify Theft in the COVID-19 Economic
Injury Disaster Loan Program
May 6, 2021

2-1
Appendix 2: Agency Response
U.S. Small Business Administration
Response to Report

U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416

To:

Hannibal “Mike” Ware

Inspector General

U.S. Small Business Administration

From:
Jihoon Kim, Director
Office of Financial Program Operations
Office of Capital Access

Date:
October 21, 2024
Subject:
Response to OIG Draft Report – “Approved Disaster Assistance Loans Matching
COVID-19 EIDLs and PPP Loans with Fraud Hold Codes”

We appreciate the role the Office of Inspector General (OIG) plays in working with management
in ensuring that our programs are effectively managed, and for the feedback provided in this
draft report. We offer the following comments to the draft and recommendations:

Recommendation 1 – We recommend the Administrator direct the Associate Administrator for
the Office of Capital Access to review the 187 loans that matched to a related COVID-19 EIDL
or PPP loan with a fraud hold code for legitimacy and eligibility. If any of the 187 loans are
found to be illegitimate, ineligible, or fraudulent, take appropriate action to 1) prevent
disbursement of funds, 2) recover the funds, and 3) refer potentially fraudulent loans to OIG.

SBA Response: SBA agrees and will review the 187 loans provided by OIG.  If any of those
loans are found to be illegitimate, ineligible, or fraudulent, SBA will take appropriate action.

JI KIM
Digitally signed by JI KIM
Date: 2024.10.21 13:31:50
-04'00'

File and source

File

25-03-disaster-loans-matching-eidl-ppp-hold-codes.pdf

Size

930,995 bytes

SHA-256

b4127970afb29fd970f51a29b7c22a6246398e147d0e45a3fd5a0fa8f19c17af

Our copy

25-03-disaster-loans-matching-eidl-ppp-hold-codes.pdf

Original

www.sba.gov