Report Limitations

Full text

Exhibit 5
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 1 of 31 PageID #:
609

Exhibit 5 - Page 1
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 2 of 31 PageID #:
610

Report Limitations
General Limitations
The information contained herein has been prepared by Alvarez & Marsal Disputes and Investigations, LLC (A&M) and is based upon financial, regulatory,
and other data provided by management and staff of the Company, including access to source systems, and other sources deemed reliable by A&M. A&M
further relied upon the assurance of management of the Company that they were unaware of any facts that would make the information provided by them to
A&M incomplete or misleading. A&M has not subjected the information contained herein to an audit in accordance with Generally Accepted Auditing or
Attestation Standards or the Statement on Standards for Prospective Financial Information issued by the AICPA. Accordingly, A&M cannot express an opinion
or any other form of assurance on, and assumes no responsibility for, the accuracy or correctness of the historical information, system data, or the
completeness and achievability of the projected financial data, information, and assessments upon which the enclosed report (the "Report") is presented.
PPP Limitations
Due to the timing of this independent assessment in relation to the release of rules and guidance for the Paycheck Protection Program (PPP), A&M's
assessment does not consider or incorporate risk relating to the loan forgiveness phase. While the loan forgiveness phase is an integral part of the program
and likely includes unique inherent risks faced by Kabbage, the incomplete guidance at the time of the beginning of this assessment prevented A&M from
both assessing the guidance as well as any Kabbage policies or procedures in relation to the guidance. As such, A&M does not offer in this report any
observations or opinions relating to this phase of the PPP and recommends Kabbage perform additional testing on this phase once the SBA guidance and
Kabbage policies and procedures are finalized.
Kabbage I June 05, 2020
ALVAREZ & MARSAL

Exhibit 5 - Page 2
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 3 of 31 PageID #:
611

Executive Summary
Pursuant to an engagement letter dated May 8th, 2020, between Kabbage, Inc. (Kabbage) and
independent risk assessment and targeted testing of Kabbage's Paycheck Protection Program (PPP).
product launch through May 20th, 2020.
A&M Disputes and Investigations, A&M performed an
The covered period for this assessment was from initial
The independent risk assessment and testing was performed through telephonic interviews of relevant Kabbage personnel, an assessment of relevant
compliance and operational documentation, and a high-level review of certain controls in place with relation to the PPP. See Appendices A and B of this
report for a list of documents assessed and personnel interviewed, respectively.
Overall, A&M observed a PPP compliance program that generally appears to be consistent with the SBA's PPP Interim Final Rules guidance and applicable
BSA/AML and OFAC requirements and our understanding of regulatory expectations. We also observed that Kabbage is currently in the midst of enhancing
controls and making key operational changes to comply with evolving SBA PPP guidance changes.
Through A&M's targeted independent assessment and testing, relevant risks and controls were identified. Kabbage should leverage the risk and control
matrix provided to address high risk areas with control enhancements. In addition, as rule changes are issued, and other key risks are identified internally,
Kabbage should update the risk and control matrix to account for such changes (e.g., loan forgiveness interim final rule guidance). The risk and control matrix
should be a tool used by Kabbage that is constantly evolving.
In conclusion of the risk assessment and testing, A&M identified areas of improvement to strengthen compliance and operational processes and noted them
in the recommendations sections of the Risk and Control Matrix and Independent Testing.
Kabbage I June 05, 2020
ALVAREZ & MARSAL

Exhibit 5 - Page 3
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 4 of 31 PageID #:
612

I

Exhibit 5 - Page 4
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 5 of 31 PageID #:
613

Scope and A&M Approach
Scope
■
A&M Shall provide the following services to the
Company:
— (1) Conduct an independent risk assessment on
the Payment Protection Program (PPP) loans;
— (2) Provide a risk assessment report, including
recommendations to mitigate identified risks;
(3) Review of applicable policies and procedures;
— (4) Review existing red flags, and recommend
additional red flags as necessary that indicate
potentially suspicious activity, specifically as they
relate to fraud;
— (5)
Independent testing
and
report
of the
program/processes, including recommendations
to address findings; and
— (6) Such other services as may be agreed to by
A&M and the Company.
Kabbage I June 05, 2020
4
A&M Approach
■
A&M will accomplish the services listed in the scope
section through the following:
— (1)
Document
review
(policies,
procedures,
previous
assessments,
previous
exams,
organizational
charts,
and
other
relevant
information);
(2) Telephonic interviews;
— (3)
Observation
and
review
of
processes
(customer onboarding, CDD/EDD, transaction
monitoring,
PEP
&
Sanctions
screening,
suspicious activity reporting, risk modeling, and
investigations);
(4) Discussion with senior compliance staff
ALVAREZ & MARSAL

Exhibit 5 - Page 5
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 6 of 31 PageID #:
614

I

Exhibit 5 - Page 6
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 7 of 31 PageID #:
615

Risk Assessment Methodology
Framework for Measuring Residual Risk
This risk assessment is designed to assist
management in evaluating compliance and
operational
risks
related
to
Paycheck
Protection Program (PPP). A&M took existing
policies, procedures and identified internal
controls into consideration in the evaluation of
residual risk for Kabbage. Residual risk is a
function of two separate components: (i) the
institution's inherent risk and (ii) the institution's
Quality of Risk Management (QRM).
Inherent risk is a measure of the risk created
by a particular institution-wide characteristic or
products assuming that the institution has no
controls in place to manage that risk. QRM is a
measure of the controls in place at a particular
institution to control its overall inherent risk. To
appropriately understand residual risk, it is
necessary to understand both inherent risk and
QRM. For example, an institution with high
inherent risk may nevertheless have low or
moderate residual risk if the institution has
strong QRM.
Kabbage I June 05, 2020
Inherent Risk & QRM
A&M prepared this assessment based on
Interim Final Rule guidance from the Small
Business Administration (SBA). A&M held
discussions with members from Kabbage's
compliance, risk and business teams on May
29th,
2020
and
June
1st,
2020,
telephonically to discuss the PPP product
offering.
We identified inherent risk factors that drive
Kabbage's
PPP
risk.
Inherent
risk
is
expressed as a risk consideration (Low,
Moderate and High) and reflects the extent
to which that particular inherent risk factor
drives the overall inherent risk.
We also identified QRM categories that
mitigate Kabbage's inherent risk. QRM is
expressed as a risk consideration (Strong,
Satisfactory and Needs Improvement) and
reflects Kabbage's overall risk mitigation in
relation to the PPP product.
A&M Risk Ratings and Kabbage Updates
A&M's risk ratings are based on A&M's
independent observations of Kabbage's PPP
compliance program and leverage policies,
procedures,
sample
documentation,
interviews, and other communication with key
PPP personnel.
Kabbage should adjust any risk ratings
provided in the Risk and Control Matrix to
reflect changes in risk and thus treat the
Matrix as a living document. Additionally, any
incomplete sections of the Risk and Control
matrix should be completed to finalize the
initial draft of the matrix.
As such, Kabbage should update the risk and
control matrix when one of the following
events occur:
■
Updates to SBA PPP regulatory guidance
■
Identification of additional risk factors
internally
■
Updates to any operational/compliance
processes
ALVAREZ & MARSAL

Exhibit 5 - Page 7
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 8 of 31 PageID #:
616

Risk Considerations — Residual Risk
A product or process where internal controls and risk management systems mitigate substantially all of the inherent risk. Management proactively identifies and
controls regulatory and operational risks undertaken by the institution and responds promptly to changes in the institution's risk profile. Internal controls and risk
management systems are commensurate with the magnitude and complexity of the product or process. Incidents and exceptions are not expected to occur and
if they did occur would not be material or part of a pattern. No impact to Kabbage's earnings or capital is likely. Management reports and information systems
are appropriate to keep management and the Board informed of Kabbage's risk profile.
A product or process where internal controls and risk management systems manage most of the inherent risk, but a significant portion of risk is not controlled.
Management identifies regulatory and operational risk and responds to changing conditions, but gaps are present. Internal controls and risk management
Moderate
systems are not fully commensurate with the magnitude and complexity of the product or process. Incidents and exceptions may occur from time to time and
they could be material or part of a pattern. A material impact to Kabbage's earnings and capital could occur. Management reports and information systems are
not adequate to keep management and the Board informed of Kabbage's risk profile.
A product or process where internal controls and risk management systems manage little or none of the inherent risk and large gaps exist. Management may
identify regulatory and operational risk, but response to changing conditions is inadequate. Internal controls and risk management systems are not
commensurate with the magnitude and complexity of the product or process. Incidents and exceptions do occur regularly and they are material or part of a
pattern. A material impact to Kabbage's earnings and capital has occurred or is imminent. Management reports and information systems are not present or are
not adequate to keep management and the Board informed of Kabbage's risk profile.
Kabbage I June 05, 2020
ALVAREZ & MARSAL

Exhibit 5 - Page 8
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 9 of 31 PageID #:
617

Risk Considerations — Inherent Risk
The volume, size, or nature of the product or process is such that in the absence of functional controls, losses or violations of law or regulation would have little
negative impact on Kabbage's earnings and capital.
Moderate
The volume, size or nature of the product or process is such that in the absence of functional controls losses or violations of law and regulation would have a
material effect on Kabbage's earnings and capital.
The volume, size, or nature of the product or process is such that in the absence of functional controls losses or violations of law and regulation would have a
material impact on Kabbage's earnings and capital. A critical inherent risk also implies that absent functional controls losses or violations have occurred or are
imminent.
* Inherent risk is often described as a pure state where no controls whatsoever exist. In practice this pure state never exists and the concept proves to be an impediment to fully appreciating risk management
methodology. We use the term 'functional controls' here to acknowledge that some form of structure probably exists, but is not targeted to the specific risk; in other words does not functionally control the specific
risk. Inherent risk establishes a practical starting point for application of controls and risk management systems, which will function to mitigate inherent risk to a level that is within Kabbage's risk appetite.
Kabbage I June 05, 2020
ALVAREZ & MARSAL

Exhibit 5 - Page 9
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 10 of 31 PageID #:
618

Risk Considerations —Quality of Risk Management
Kabbage's risk management systems fully identify and appropriately control all risks posed by the product or process. The risk management framework as
applied to the product or process contains all required elements, including board and executive management participation, established risk appetite, risk
assessment, policies and procedures, reporting, testing and monitoring, audit, appropriate risk management and reporting systems. Losses, exceptions, and
violations of law or regulation are rare and not material to Kabbage's earnings and capital.
The Kabbage's risk management systems identify and appropriately control most risks posed by the product or process, but some gaps may exist. The risk
management framework as applied to the product or process contains most required elements, including board and executive management participation,
Sat. facto
established risk appetite, risk assessment, policies and procedures, reporting, testing and monitoring, audit, appropriate risk management and reporting systems.
Some of the elements of the risk management framework may not be fully developed or gaps may exist. These may increase the residual risk level, but do not
result in an unacceptable residual risk. Losses, exceptions, and violations of law or regulation may be expected on a regular basis, but they are not material to
Kabbage's earnings and capital.
The Kabbage's risk management systems do not identify and appropriately control significant risks posed by the product or process; substantial gaps exist. The
risk management framework as applied to the product or process may be lacking minimum required elements such as policies and procedures, testing and
_
monitoring, or reporting and risk management systems. Board and executive management participation may be insufficient. There may be gaps or deficiencies
in the framework and these may point to an overall deficiency in the framework itself. Risk management does not minimally control the risk of the product or
process and residual risk is outside risk appetite. Losses, exceptions, and violations of law or regulation have occurred or are imminent and either have or
predictably will result in material harm to Kabbage's earnings and capital.
Kabbage I June 05, 2020
ALVAREZ & MARSAL

Exhibit 5 - Page 10
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 11 of 31 PageID #:
619

Residual Risk Rating Mapping
Kabbage I June 05, 2020
10
ALVAREZ & MARSAL

Exhibit 5 - Page 11
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 12 of 31 PageID #:
620

Risk & Control Matrix
Control
Control Ref Title
Risk
Inherent
Risk
Control(s)
QRM Rating
Rating
Residual
Risk
Rating
Recommendation
PPP I
Regulatory Kabbage does not identify
flI
Kabbage has personnel dedicated to monitoring SBA PPP
1ii.i
Moderate
1) Kabbage should consider
regulatory updates
updates and communicating questions and concerns as they
updating its PPP program manual
arise. The following Kabbage personnel are listed as authorizing
to include the roles and
officials with the SBA for Kabbage:
responsibilities of Kabbage
personnel. The roles and
1) Spencer Robinson (Head of Strategy) - official contact for E-
responsibilities should include who
trans
is responsible for SBA
2) Azba Habib (BSA/AML Officer) - official contact for regulatory
communication and
compliance
tracking regulatory updates.
In addition, Sam Taussig (Head of Policy) has direct access to the
2) Given the departure of
SBA's department head.
Kabbage's BSA/AML Officer, Azba
Habib, as of June 6, 2020,
Kabbage should consider updating
any contact information with the
SBA to that of the interim or new
BSA/AML Officer.
PPP 2
Regulatory Management does not provide
fF1
Kabbage communicates regulatory updates relevant to the Satisfactory
flI
1) Kabbage should consider, when
relevant information pertaining to
appropriate teams through the following methods:
able, documenting in the PPP
PPP regulatory changes to the
program manual regulatory and
review team
1) An email listsery for department heads
other key changes to the PPP
2) Slack channels utilized by each PPP process team
requirements, processes, and
procedures which are identified in
3) Daily morning meetings with department heads which dive into
meetings, emails, and slack
granular issues
channels.
4) Daily afternoon meetings with a larger audience which
discusses key themes and concerns which may need to be
discussed with the SBA. The larger audience at times may include
the
following
personnel:
CEO,
CCO,
BSA/AML
Officer,
Department Heads, and other personnel as warranted.
Kabbage I June 05, 2020
if
ALVAREZ & MARSAL

Exhibit 5 - Page 12
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 13 of 31 PageID #:
621

Risk & Control Matrix
Control
Inherent
Residual
Control Ref Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 3
Staffing
Kabbage does not maintain the
appropriate staffing levels to
support the high volume and
time constraints related to PPP
PPP 4
Customer
Kabbage does not have an
Identification adequate BSAIAML program
Program
that includes a CIP in place to
(CIP)
identify PPP applicants,
resulting in potential fraudulent
loans.
PPP 5
KYC/CDD
Kabbage does not have a
process to adequately perform
customer due diligence on
applicants and beneficial
owners.
Kabbage I June 05, 2020
Per conversation with Kabbage management, the Company Satisfactory
appears to be staffed to handle the volume of applications and risk
tickets that are being generated.
The risk group has —6 risk analysts and are able to close risk
tickets between 1-10 days (including applicant response time).
Per Spencer Robinson, if volumes for applications or risk tickets
spike, they will engage consulting resources they leveraged in the
past to address staffing needs.
Additionally, Kabbage advised they are able to team resources
with financial institution partners such as Cross River and
Customers Banks.
Moderate
Kabbage has a BSA/AML program in place that includes a
Satisfactory
Moderate
Customer Identification Program (CIP). More specifically, Kabbage
has a KYC framework that provides for risk-based customer
identification, verification, and due diligence.
Kabbage has BSA(AML and Fraud procedures for PPP loan
applications. Included in the procedures are processes for
Kabbage to run OFAC and KYB/KYC Checks.
OFAC
Leverages a tool called GIACT, which provides results based on a
composite of sanctions lists.
KYC/KYB
Leverages LexisNexis & CLEAR to perform KYC/KYB verification
for the business applicant, the authorized representative, and any
owner with 20% or greater interest.
12
1) Kabbage should consider
updating their PPP organizational
chart to include application
reviewers and risk analysts and
their direct reporting lines.
1) As of April 2020, Kabbage is still
refining its customer risk
segmentation process for PPP
loans and expects this process will
likely be different from the
standard CRR. Once
implemented, Kabbage may want
to perform a risk-based review of
applicant loans.
Moderate
N/A
ALVAREZ & MARSAL

Exhibit 5 - Page 13
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 14 of 31 PageID #:
622

Risk & Control Matrix
Control
Inherent
Residual
Control Ref Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 6
Application
Kabbage does not have an
•
Kabbage has a dedicated PPP loan application landing page. The
•
N/A
Review
adequate PPP customer
landing page prompts questions to the applicant that answer the
application that captures all
SBA loan application requirements (i.e., payroll requirements,
required borrower information
relevant
documents,
corporate
groups, and
certifications).
in SBA Form 2483 and payroll
Included in the landing page is a document upload prompt,
documentation
whereby the applicant must upload the necessary documentation
needed to fulfill the application review.
PPP 7
Application
Kabbage submits applicants for
Kabbage has a process in place to decline applicants based on Satisfactory
1) Update procedures to reflect
Review
PPP loan approval to the SBA
the following knock-out rules:
minimum timeframes and dates.
who do not meet the eligible
(e.g., 5 years timeframe for felony)
borrower requirements
1) Authorized business representative and/or any of the owners
with 20% or greater interest in the Applicant is a non-U.S. citizen
2) Update procedures/manual to
include language from:
2) Applicants falls into an ineligible industry
htt ps : //www.fe d e ra l re g i ste r. g o v/d /2
3) Applicant has >500 employees
020-08257/p-56 &
htt ps : //www.fe d e ra l re g i ste r. g o v/d /2
4) Applicant started operation after February 15, 2020
020-09098/p-26
5) Applicant is self-employed (sole-proprietorship or Single LLCs)
who started in 2020
6) Applicant has an Associate or an owner who is incarcerated, on
probation, on parole, or has been indicted for a felony or a crime of
moral turpitude
7) Applicant is currently involved in bankruptcy proceedings
PPP 8
Application
Kabbage submits multiple PPP
As part of Kabbage's online application it requires the borrower to
N/A
Review
loan applications to the SBA for
confirm they are not receiving an additional PPP loan. The
single entities
language states the following:
"During the period beginning on February 15, 2020 and ending on
December 31, 2020, the applicant has not and will not receive
another loan under the Paycheck Protection Program".
In addition, per conversation with Amit Kesarwani, Kabbage runs a
query that compares the information from the new borrower
application to existing customer information. The query will flag
any applications with duplicate information.
Kabbage I June 05, 2020
13
ALVAREZ & MARSAL

Exhibit 5 - Page 14
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 15 of 31 PageID #:
623

Risk & Control Matrix
Control
Inherent
Residual
Control Ref Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 9
Application
Applicants submit inaccurate,
Moderate
Kabbage has two types of application reviews (manual and
Review
insufficient, or fictitious
automated). As part of the manual review process, Kabbage has
documentation
procedures in place that detail step by step instructions on how to
review PPP loan applications. Included in the "PPP Document
Review Guide in Kore" procedures are sections that address:
1) Getting started with Kore
2) How to find documents and fill in the fields (i.e., W-3, W-2s, 940
tax form, verified government ID, etc.)
3) How to request a document in Kore
4) Where to see information about a customer's application?
5) Common errors and what they mean?
6) FAQ's
In addition to the "PPP Document Review Guide in Kore",
Kabbage has targeted procedures for specific customer types (i.e.,
General Partnerships, Seasonal Businesses, PEO's)
Per conversations with Kabbage Management, —75% of all PPP
application reviews are fully automated and run through straight
through processing leveraging OCR technology.
Kabbage I June 05, 2020
14
N/A
ALVAREZ & MARSAL

Exhibit 5 - Page 15
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 16 of 31 PageID #:
624

Risk & Control Matrix
Control
Inherent
Residual
Control Ref Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 10
Payroll
Kabbage calculates PPP
applicant payroll inaccurately
Kabbage I June 05, 2020
Kabbage has an Overview of Protection Program Calculations and
Verification Procedure document which outlines:
1) The overarching process Kabbage follows to determine and
verify loan amounts
2) Details regarding the data and calculations used
3) The quality assurance/quality control (QA/OC) procedures that
are in place
As part of the QA/QC Kabbage performs both a manual and
automated review.
Manual Review
QA/CC Procedures: When a Google Sheet has been completed,
a Kabbage employee (auditor) reperforms the review procedures
outlined above for 10% of the loan applications. If an error is
discovered, the auditor corrects the Google Sheet and reperforms
an additional judgmental sample size. Once the audit has been
completed, the Google Sheet is marked as complete. If an auditor
identifies a repetitive issue, they meet with the employee and
explain exactly what is being missed. Additional work is further
validated to ensure the training is successful.
Automated Review
Certain PPP loan applications can be processed in an automated
flow using optical character recognition (OCR). Today the OCR
capability is applicable to tax documents (940, 1099, W-3, etc.),
which have very standardized, machine-readable formats.
To
perform verification, Kabbage performs several checks, which
involve a document validation and an extracted values process.
In
addition,
Kabbage
maintains
targeted
procedures
for
documentation issues and specific customer types (i.e., PEO's,
Seasonal Businesses, General Partnerships).
15
Moderate
1) Update language regarding the
compensation of an individual
employee in excess of $100,000
per year.
2) Update Seasonal SMB section
to reflect 2019 and 2020 and not
3019 and 3030, respectively.
ALVAREZ & MARSAL

Exhibit 5 - Page 16
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 17 of 31 PageID #:
625

Risk & Control Matrix
Inherent
Residual
Control Ref Control Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 11
Regulatory
Kabbage knew or should
fl I
Kabbage performs fraud checks on applications through a process
-
1) Update "Overview of Paycheck
have known it was
which utilizes the following tools:
Protection Program BSA/AML
transmitting fraudulent
Procedures" to require Fraud
information to the SBA
1) Emailage
Review Team to clear an
2) Sentilink
application's suspected fraud
flag(s) prior to submission to the
3) Threatmetrix
SBA for loan approval. Current
The above tools produce a score for each application. If the score
procedure appears to allow for
is high, an "SBA Failed Manual Verification" flag is created on the
application to proceed to the SBA
account and remains until processed by the Fraud Review Team.
prior to flag review.
Funds for the application are not able to be disbursed until the flag
is cleared by the Fraud Team.
PPP 12
Loan
Kabbage does not disburse
Prior to loan disbursement the customer is provided a DocuSign
Satisfactory
1) To ensure compliance with the
Disbursements loan funds within ten
envelope for signature and asked 6 KBA questions. The customer
disbursement of loan funds within
calendar days of loan
must answer 4 of 6 KBA questions correct to move forward. If the
ten calendar days of SBA loan
approval
answers are correct, the customer signs and loan funds are
approval, Kabbage should
disbursed within 10 calendar days from when the loan was
consider updating their KBA failure
approved by the SBA (i.e., from when the guarantee number was
procedures to detail the timeframe
issued by the SBA) .
a KBA failure must be remediated.
In addition, Kabbage has a KBA Failure procedure for instances
2) Update BSA/AML and Fraud
where the borrower fails the KBA test. The applicant must call in to
procedures to require Fraud
initiate the escalated review, and the frontline team will create a
Review Team to clear a flag prior
salesforce ticket attached to the application. The account review
to SBA approval of funds. This will
team will then review the ticket and relevant documentation to
prevent previously unreviewed or
either clear the ticket or flag the applicant preventing them from
unresolved flags from delaying
loan disbursement and a SAR may be filed.
Kabbage's ability to disburse
loans.
PPP 13
Loan
Kabbage does not submit
Moderate
Per conversation with the Kabbage team, the first SBA Form 1502
Satisfactory
Moderate
1) Kabbage should create
Disbursements SBA Form 1502 indicating
submission through E-trans was executed on 5/25/2020. The
procedures detailing the PPP loan
that PPP loan funds have
Kabbage team plans to upload a bulk SBA form 1502 on a weekly
disbursement reporting
been disbursed in a timely
basis,
requirement, which include at a
manner
minimum
Roles and responsibilities
SBA Form 1502 requirements
Kabbage I June 05, 2020
16
ALVAREZ & MARSAL

Exhibit 5 - Page 17
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 18 of 31 PageID #:
626

Risk & Control Matrix
Control Ref Control Title
Risk
Inherent
Risk
Control(s)
QRM Rating
Rating
Residual
Risk
Recommendation
Rating
PPP 14
Suspicious
Kabbage does not have a
Moderate
Kabbage identifies suspicious activity at the time of onboarding
-
Moderate
1) Kabbage should consider
Activity &
process in place to identify
and monitors for the same throughout the lifecycle of the
-
creating SAR procedures that
Monitoring
and report unusual activity.
borrower. In the event suspicious activity is identified, Kabbage
include escalation of suspicious
will refer (in the event a bank partner is the PPP lender) or report
activity and how to complete a
(in the event Kabbage is the PPP lender) such activity to its bank
SAR. Kabbage may want to
partner or the Financial Crimes Enforcement Network ("FinCEN"),
consider creating a SAR narrative
respectively,
template that incorporates
FinCEN's SAR Narrative Guidance
In addition, Kabbage leverages the following tools to identify
("who, what, where, when, why")
instances of fraud:
1) Sentilink (Daily Batch) - identifies instances of fabricated or
manipulated identifies.
2) Emailage (Daily Batch) - identifies emails associated with fraud
3) Threatmetrix (Sign-in Disbursement) - Identifies if applicant
device has been associated with multiple application or previously
identified fraudulent customers
4) TLO (Manual) - manual review tool that provides business,
personal, and social media records to validate
5) Inscribe (Manual) - identifies fraudulent documents
6) DocuSign KBA (Real-time) - Asks questions to authenticate
identity of signer
PPP 15
Suspicious
Suspicious activity is not
Moderate
Kabbage
leverages
an
excel
workbook
named
-
Moderate
1) Kabbage should consider
Activity &
tracked and monitored.
"Fraud_suspect_list" to track suspicious activity and instances of
creating a formalized suspicious
Monitoring
fraud. The workbook includes the userid and business name of
activity tracking document that
the accounts with suspicious activity,
details at a minimum:
•
Identification dates
•
Reason for flagging
•
Notes related to the
investigation of the potentially
suspicious activity
•
If a SAR has been filed
•
SAR/No SAR decisioning
Kabbage I June 05, 2020
17
ALVAREZ & MARSAL

Exhibit 5 - Page 18
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 19 of 31 PageID #:
627

Risk & Control Matrix
Control Ref Control Title
Risk
Inherent
Risk
Control(s)
QRM Rating
Rating
Residual
Risk
Recommendation
Rating
PPP 16
Data Retention Data provided by the
fl I
Kabbage's enterprise-wide data retention policy is contained in "4
Satisfactory
ff1
1) Update Data Retention section
borrower related to loan
- Kabbage Information Security Policy v1 (approved 2019-12-31)"
(7.4) of Kabbage's Information
application, approval,
and outlines the following:
Security Policy document to
disbursement, or forgiveness
require Kabbage retain PPP data
is not retained by Kabbage
1) Data Classification by level of sensitivity includes (from least to
for a minimum of six years (as well
fora minimum of 6 years.
most restrictive): Public Data, Confidential Data, and Restricted
as the BSA/AML data for a
Data;
minimum of five years from the
2) All data determined "critical to Company operations and/or
date of last activity on the
team member job functions" must be backed up;
account).
3) Network and data security processes;
2) Ensure PPP data is retained
onsite at Kabbage's principle place
4) Requirement of Restricted Data to be transferred via encrypted
of business in Atlanta and able to
methods only;
be compiled and supplied to the
Additionally, Kabbage's "Enterprise BSA_AML and OFAC Policy
SBA upon request within one
(AH Draft 4.27.20)(v2)" outlines the record retention and record
business day.
keeping policies relating to their BSA/AML requirements, which
3) A&M recommends clearly
include:
classifying the following PPP
1) Retention of information related to BSA/AML requirements for a
related data as either Restricted or
period of at least five years from the date of last activity on any
Confidential Data in accordance
one Account;
with Kabbage policies:
documentation received from
2) A list of the related BSA/AML data types to be retained,
borrowers, communications with
borrowers, internal assumptions or
decisions made by Kabbage
relating to a loan calculation or
forgiveness, and any other
relevant data related to loan
application, calculation, approval,
disbursement, forgiveness, and/or
repayment.
Kabbage I June 05, 2020
18
ALVAREZ & MARSAL

Exhibit 5 - Page 19
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 20 of 31 PageID #:
628

Risk & Control Matrix
Inherent
Residual
Control Ref Control Title
Risk
Risk
Control(s)
QRM Rating
Risk
Recommendation
Rating
Rating
PPP 17
Internal Fraud
Kabbage personnel do not
Moderate
Kabbage maintains Quality Assurance / Quality Control processes
Satisfactory
Moderate
N/A
execute their responsibilities
to combat the ability and effectiveness of internal fraud, including:
fully or with integrity
1) Application Review- Random selection by management of 3
tickets from each review team member's queue (weekly basis);
2) PPP payroll Calculation Review - Review of 10% of the manual
loan applications in each Google Sheet, and an automated
processing QA/QX which validates document types and extracted
values.
Kabbage I June 05, 2020
19
ALVAREZ & MARSAL

Exhibit 5 - Page 20
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 21 of 31 PageID #:
629

I

Exhibit 5 - Page 21
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 22 of 31 PageID #:
630

Testing Methodology
Following completion of the Risk and Control Matrix, A&M utilized Kabbage's policy and procedure documentation to walk through a random sample of ten
(10) applications previously approved by Kabbage and the SBA for a PPP loan. The purpose of the testing was to track and provide Kabbage with
observations and recommendations which might assist in identifying areas of opportunity in the PPP loan program.
To begin testing, A&M utilized a random number generator to select ten (10) approved borrowers from a list of the 76,726 applicants Kabbage had approved
by the beginning of this assessment. Once selected, A&M requested the following categories of documentation from Kabbage for each of the 10 borrowers
(now samples):
1. KYC/KYB/OFAC Check documentation
2. Payroll/Loan Amount Verification documentation
3. Fraud Review documentation
4. Background Check documentation
5. KBA Check documentation
6. E-Tran approval date and number
7. Other relevant documentation that may relate to the loan application and approval process
Finally, the testing utilized A&M's knowledge of Kabbage's processes gained through generation of the Risk & Control Matrix as well as Kabbage's PPP
policies and procedures to analyze borrower documentation provided to the lender as part of the loan approval process. A&M's analysis concluded with the
generation of observations and recommendations intended to assist Kabbage in identifying areas of focus or opportunity for the PPP loan program. The
results and observations from sample testing are contained in the following slides.
Kabbage I June 05, 2020
21
ALVAREZ & MARSAL

Exhibit 5 - Page 22
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 23 of 31 PageID #:
631

Independent Testing
KYC/KYB Testing Dashboard
1

2

3

4

5

6

7
01/R1
~✓~
8

9
10

Test passed.
0
A&M observation noted.
R
A&M recommendation.
Kabbage I June 05, 2020
22
Test Steps:
1)
Verify the customer has passed the BVI test in LexisNexis
(>=40).
2)
Verify the customer was screened and not a match in GIACT.
Observations/Recommendations:
01/R1) Customer failed BVI check. A&M noted BSA/AML procedures
and/or the KYB/KYC Desktop Procedures should more clearly
account for process for EDD when BVI score in CLEAR is below 40.
ALVAREZ & MARSAL

Exhibit 5 - Page 23
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 24 of 31 PageID #:
632

Independent Testing
Payroll/Loan Amount Verification Testing Dashboard
1
2
01
3
4

5
02
6
02
7
 03'______
8

9
shy .
10

*A&M did not perform a recalculation of Kabbage's payroll calculation.

Test passed.
0
A&M observation noted.
Kabbage I June 05, 2020
23
Test Steps:
1)
Verify
the
customer
has
provided
all
required
payroll
documentation.
Observations:
01) Missing the following documents: 2019 IRS Form 940; Payroll
statement covering 2/15/2020.
02) Missing 2019 IRS Form 940.
03) A&M noted that the borrower did not provide IRS Form 940.
However, the borrower provided a paystub evidencing the year to date
federal and state withholding taxes.
04) W-3 form was not provided. However, the borrower uploaded
documentation evidencing total number of employees and detailed
payroll schedules.
ALVAREZ & MARSAL

Exhibit 5 - Page 24
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 25 of 31 PageID #:
633

Independent Testing
Fraud Testing Dashboard
1

2

3

4

5

6

8

Test passed.
0
A&M observation noted.
Kabbage I June 05, 2020
24
Test Steps:
1)
Verify the customer passed the Emailage fraud check.
2)
Verify the customer passed the Sentilink fraud check.
3)
Verify the customer passed the Threatmetrix fraud check.
Observations:
A&M made no new observations for this section of the independent
testing.
ALVAREZ & MARSAL

Exhibit 5 - Page 25
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 26 of 31 PageID #:
634

Independent Testing
KBA/E-Tran/DocuSign Testing Dashboard
Test Steps:
1
01/R1

r
1)
Verify Kabbage ran the customer against LexisNexis RiskScreen
Background Check.
2
01/R1

2)
Verify the application was successfully submitted through E-Tran.
3
01/R1

/
r
3)
Verify the applicant passed the KBA requirements.
4)
Verify the customer signed the DocuSign envelope.
4
01/R1
V

5
01/R1

~

6
01/R1

7
01/R1
✓~

Observations:
—
01/R1) Sample(s) appear to have triggered a manual background
8
01/R1

review based on the "Note" in the Background Check CSV file
provided to A&M. A&M noted Kabbage does not have a clear
9

procedure for performing manual background checks when the
02
applicant fails the automated process.
10
02
84"

02) Sample(s) provided to A&M do not appear to contain results of
any performed background checks.

Test passed.
0
A&M observation noted.
R
A&M recommendation.
Kabbage I June 05, 2020
25
ALVAREZ & MARSAL

Exhibit 5 - Page 26
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 27 of 31 PageID #:
635

Exhibit 5 - Page 27
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 28 of 31 PageID #:
636

Appendix A: Documents Reviewed for Matrix
In generating the Risk & Control Matrix, A&M evaluated PPP lender risks against Kabbage's existing controls by reviewing the following Kabbage
documentation:
1 - Document Request List (5.19.20).docx
2 - PPP Data Acquisition and Storage.docx
17- PPP - Doc Uploader Scripts .docx
1(a) - Kabbage - Enterprise BSA_AML and OFAC Policy (AH Draft
4- KABBAGE INFORMATION SECURITY POLICY v1 (approved
18- PPP - App Review Audit Process (as of 5.22.20).docx
4.27.20)(v2).docx
2019-12-31) copy.docx
1(b) - Kabbage - BSA_AML and Fraud Procedures for PPP (AH
6- Listing of all applicants (1).csv
Draft 4.30.20) copy.docx
1(c) - Desktop Procedures - OFAC Screening (4_2020) copy.docx
7- Listing of all approved applicants (1).csv
1(d) - Desktop Procedures - KYB_KYC (4_2020) copy.docx
8 - Fraud_suspect_list.xlsx
1(e) - Desktop Procdures - Sentilink, Emailiage and Threatmetrix
13 - Kabbage - 2017 BSA AML and OFAC Risk Assessment
(4_2020) copy.docx
(FINAL)(March 2018).docx
1(g) - Desktop Procedures - KBA Failure copy.docx
1(h) - PPP Calculations and Verification.docx
10)- Payroll Verification Document Mapping.docx
1(J)(k).pptx
Kabbage I June 05, 2020
19- General Partnerships Loan Calculation.docx
20 - Seasonal Training — Tis the season for seasonal.docx
21 - 4.25 Miscategorized PPP Apps.xlsx
22 - SUSPICIOUS PPP APPS (REVIEWERS).xlsx
13 - Kabbage - 2018 BSA AML and OFAC Risk Assessment (FINAL
23-2018 Enterprise BSA_AML & OFAC RA Remediation Plan (as
7.19.19).docx
of 5.29.30).xlsx
14- Kabbage - 2019 BSA-AML-OFAC Audit Report_FINAL_2019-
PPP - Compliance Review Assignment.xlsx
11-04. pdf
15 - PPP - Document Review Guide + Kore - UX Update.docx
16 - PPP - Teach me how to PEO.docx
27
ALVAREZ & MARSAL

Exhibit 5 - Page 28
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 29 of 31 PageID #:
637

Appendix B: Interviewed Personnel
In performing the independent risk assessment, A&M evaluated PPP lender risks against Kabbage's existing controls by interviewing the following Kabbage
personnel:
Kristel Adler
PPP Business Owner
Nan Slier
PPP Application Manual Review Process Lead
Azba Habib
BSA/AML Compliance Lead for PPP
Spencer Robinson
PPP Overall Risk & Strategy
Nipun Goel
PPP Strategy Lead for Acceptable Documentation, Eligible Businesses, and Loan Calculations
Sam Taussig
PPP Government Relations & Policy
!cabbage I June 05, 2O2(
28
ALVAREZ & MARSAL

Exhibit 5 - Page 29
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 30 of 31 PageID #:
638

Alvarez & Marsal Holdings, LLC. All rights reserved. ALVAREZ & MARSAL®,
At ® and A&M® are trademarks of Alvarez & Marsal Holdings, LLC.
© Copyright 2020
0000

Exhibit 5 - Page 30
Case 4:21-cv-00110-SDJ     Document 68-5     Filed 03/11/25     Page 31 of 31 PageID #:
639

File and source

File

gov.uscourts.txed.204031.68.5.pdf

Size

39,466,928 bytes

SHA-256

fe2e842354f86ce4fbebcecd31f7fcf7bbc5fda4227c8e6f1b99f32468c69cd9

Our copy

gov.uscourts.txed.204031.68.5.pdf

Original

PACER (login required)