Letter from RER Solutions counsel to Chairman Clyburn and Chairwoman Velazquez, Mar. 11, 2021

Summary

A March 11, 2021 letter from Kirkland & Ellis LLP, written on behalf of RER Solutions, Inc., to Chairman Clyburn and Chairwoman Velazquez in response to their letter dated February 11, 2021. It states that in 2018 the SBA-ODA awarded the RER-Rocket Team a loan recommendation contract after a competitive process that involved nine competing bids, and that the team began processing loans on April 6, 2020. It states that under the EIDL task order the team delivered one million recommendations in 10 days. It reports that as of February 28, 2021, 17,764,721 applications had been submitted to the Rapid Decision system, which identified 5,260,601 as duplicates, and that 6,061,347 of the 12,504,120 unique applications received a negative submission. The letter is labeled "Confidential".

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Text recognized from a scanned document; may contain errors.

KIRKLAND & ELLIS LLP

AND AFFILIATED PARTNERSHIPS

1301 Pennsylvania Avenue NW
Washington, D.C. 20004

W. Neil Eggleston United States
To Call Writer Directly: Facsimile:
+1 202 389 5016 +1 202 389 5000 +1 202 389 5200

neil.eggleston@kirkland.com

CONFIDENTIAL
March 11, 2021
The Honorable James E. Clyburn The Honorable Nydia M. Velazquez
Chairman Chairwoman
Select Subcommittee on the Coronavirus Crisis Committee on Small Business
United States House of Representatives United States House of Representatives
Washington, D.C. 20515 Washington, D.C. 20515
The Honorable Steve Scalise The Honorable Steve Chabot
Ranking Member Ranking Member
Select Subcommittee on the Coronavirus Crisis Committee on Small Business
United States House of Representatives United States House of Representatives
Washington, D.C. 20515 Washington, D.C. 20515

Dear Chairman Clyburn, Chairwoman Velazquez, and Members of the Committees:

I write on behalf of RER Solutions, Inc. (“RER”) to provide information requested by
Chairman Clyburn and Chairwoman Velazquez in your letter dated February 11, 2021.

RER has been communicating with the Committees since August 2020. Ms. Errin Green,
Chairman and Chief Executive Officer of RER, provided a briefing to your staffs on August 13,
2020. During that briefing, Ms. Green made a presentation to bipartisan staff regarding RER’s
efforts to provide an effective solution that would enable the Small Business Administration to
administer critical coronavirus crisis relief funding under the standards set by Congress in the
Cares Act.

Before the briefing, RER produced a number of documents responsive to the Committees’
requests. These included documents regarding Ms. Green’s 8(a) certification, RER’s past
performance on government contracts, the contracting proposals and documentation relating to the
original Small Business Administration (“SBA”) Office of Disaster Assistance (“ODA”) disaster
relief contract, and relating to the COVID-19 disaster relief loan processing task order added to
that ODA contract.

Beijing Boston Chicago Dallas HongKong Houston London Los Angeles Munich NewYork PaloAlto Paris SanFrancisco Shanghai
KIRKLAND & ELLIS LLP

March 11, 2021
Page 2

Since the briefing, RER provided supplementary information at the Committees’ request
in an October 2, 2020 letter. The October 2 letter provided information about the RER-Rocket
Team’s technical proposal for the ODA disaster relief funding, and the RER-Rocket team’s work
under the COVID-19 task order to the disaster relief contract in March 2020. RER also provided
the most recent modification of the COVID-19 task order, and responded to the Committees’
questions about that contract modification.

On November 25, 2020, RER provided additional information in response to specific
requests from the Committees, focused on contract management and the project’s fraud controls.
RER also produced its current invoices to the SBA, as well as information about the program’s
fraud controls.

On February 11, 2021, RER received additional requests for information and documents
from the Committees. Since that time, on March 3, 2021, the RER-Rapid-Rocket technical team
met with Committee staffs to provide a demonstration of the Rapid Decision system. The
demonstration highlighted the operation of the system’s fraud controls and checks in an interactive
environment, and the technical team answered the Committee staffs’ questions related to the
system. In addition to the information provided to the Committee staffs at that demonstration,
RER’s responses to the Committees’ recent requests for information and documents are set forth
below.

I. Background

In 2018, the SBA-ODA awarded the RER-Rocket Team a loan recommendation contract,
Contract Number 7551019D0001 (the “Contract”), after a robust competitive process that involved
nine competing bids. As the Statement of Work for the original contract makes clear, the SBA
sought a solution that could deliver a loan recommendation “within 10 minutes of ODA's request
for such service.” See RER 0000144 at RER_0000155. While the SBA stated that it was not
seeking a contractor to build or customize a system, or to purchase software or hardware, ODA
confirmed that it did “not believe it is possible to provide manual loan recommendations in the
timeframe required.” See Solicitation No. 73351018R0010 Amendment 0001 (providing answers
to questions and answers from interested contractors). In accordance with the SBA’s requested
solution, the RER-Rocket team offered a highly automated system that was flexible and scalable
enough to meet the ODA’s unique needs.

When the COVID-19 crisis hit, Congress quickly acted to implement programs to assist
small businesses under the CARES Act. The SBA-ODA approached the RER-Rocket team and
asked them to submit a proposal for loan recommendation services under their existing ODA
contract vehicle. The RER-Rocket Team, together with a second-tier subcontractor, Rapid
Finance, worked expeditiously to ensure that the Rapid Decision system could provide loan
recommendation services to the SBA in accordance with the SBA’s requirements. At the SBA’s
request, the RER-Rocket Team submitted its proposal on March 28, 2020. The next day, the SBA
KIRKLAND & ELLIS LLP

March 11, 2021
Page 3

approved the RER-Rocket Team’s EIDL proposal, and the Team immediately began work. Faced
with exigent circumstances, the RER-Rocket-Rapid Team stood up a loan recommendation
platform by the first week of April 2020 to meet the immediate demand from millions of small
businesses. By the time the Team began processing loans on April 6, 2020, small businesses—
struggling with the unprecedented demands of the COVID-19 crisis—had already submitted more
than 4 million applications.

Throughout the past year, the Team consistently outperformed the requirements of the
contract. RER’s original Contract with the SBA contemplated loan recommendations at a rate of
one million recommendations in 60 days. Under the original Contract, RER was primarily
working on home loans before the COVID-19 pandemic occurred. Under the EIDL task order,
however, the RER-Rocket team delivered one million recommendations in 10 days. The team has
identified millions of duplicate applications and proposed that the SBA reject millions more, due
to the fraud controls and checks that the system performs when assessing each loan. For example,
by February 28, 2021, the Team had identified over 5 million loan applications as duplicates, and
over 6 million loan applications received a negative decision.

The SBA has been pleased with the Team’s efforts throughout performance of the EIDL
work. The RER-Rocket Team has received positive reviews from the SBA, including the recent
Contractor Performance Assessment Review (“CPAR”), which was signed by the Contracting
Officer on October 30, 2020. The Review rated RER “Exceptional”—the highest available
rating—in every category but one, including Quality, Schedule, Cost Control, Management,
Regulatory Compliance, Administrative, and Invoices. (It rated RER “Very Good” in Small
Business.) The Contracting Officer Representative stated in the CPAR that “[g]iven what I know
today about the contractor’s ability to perform with this contract or order’s most significant
requirements, I would recommend them for similar requirements in the future.”

Il. The Committees’ Concerns About Fraud Controls

The Committees’ recent letter raises concerns about fraud controls in the EIDL program,
citing to the SBA Office of Inspector General (“SBA-OIG”) report about purported fraud control
deficiencies on the project. By the time the SBA-OIG published that report, the SBA had provided
explanations for many of the potential fraud control problems identified by the OIG and many of
the specific items identified as “potentially fraudulent EIDL loans and advances.” As an example
of “potential” fraud, the Committees’ letter cites loans made to different applicants who used the
same IP address to apply for their loan. See 02-11-2021 Chairman Clyburn and Chairwoman
Velazquez Ltr. to RER at 2. The SBA-OIG similarly identified these loans and advances as
“potentially” fraudulent. Additional investigation by the SBA, however, revealed that these
applications commonly originated from law firms, loan packagers, and certified public
accountants. The SBA attempted to contact those borrowers by phone; the borrowers that they
reached confirmed that they employed the services of attorneys, accountants, and other
KIRKLAND & ELLIS LLP

March 11, 2021
Page 4

representatives to apply for EIDL assistance. See SBA Response to Inspection Report at 51-52,
https://www.sba.gov/sites/default/files/2020- 1 1/SBA%2001G%20Report%2021-02.508.1.pdf.
The SBA’s analysis confirmed that these uses of shared IP addresses were legitimate.

Similarly, the SBA investigated additional potentially fraudulent loans identified by SBA-
OIG in its Draft Report, and provided explanations for many of the OIG’s findings. See generally
id. As another example, the OIG’s Draft Report faulted the SBA for approving loans with bank
accounts that were changed from the original application. Jd. at 49. Many of those changes were
prompted by the SBA itself. See id. The EIDL program’s banking validations and internal controls
effectively identified inconsistencies between the business applicant and the listed bank account
information; as a result, the program’s validation protocols prevented applications from moving
forward to disbursement because of bank account and routing numbers with minor errors, or
because the applicant used a personal bank account instead of a business bank account. See id.
The SBA sent emails to more than 2 million applicants on June 3, 2020 to inform them that the
SBA was unable to validate their information to process the EIDL advance, and it invited these
applicants to correct their applications. The system then ran the same validations and internal
controls against the updated information. Ultimately, the SBA was able to approve EIDL advance
funds to more than 338,000 businesses that updated their information. The system still rejected
761,000 updated applications after the second validation attempt.

Ill. Unredacted Copies of Proposals

In your February 11, 2021 letter, the Committees again request “[uJnredacted copies of any
proposals prepared by RER regarding the EIDL project.” As RER explained in its November 25
letter, these documents contain highly sensitive commercial information that could jeopardize
RER’s competitive interests if the documents were to be made public. RER previously proposed
allowing the staff to review unredacted copies of the proposals, without retaining them in the
Committees’ files. Should the Committee wish to approach this proposed accommodation in a
different way, RER remains open to discussing other ways to provide the Committee with the
information it seeks in a manner that protects RER’s legitimate interest in shielding its competitive
information from public disclosure.

IV. The Committees’ Most Recent Document Requests

A. Request 1 (Non-Disclosure or Confidentiality Agreements

Based on discussions with Committee staff, we understand that Requests 1 and 2 seek to
identify RER’s staffing of the contract. As discussed with Committee staff, non-disclosure
agreements associated with the contract may not be an effective proxy for identifying staff who
worked on the project. Given the exigency created by the COVID-19 crisis—particularly when
KIRKLAND & ELLIS LLP

March 11, 2021
Page 5

the contract was ramping up—certain employees may have signed an NDA who never worked on
the project, and others who worked on the project may not have signed an NDA.

In an effort to accommodate the Committees’ Requests 1 and 2, RER below provides a
list of its employees by title who have worked on the Contract, including all relevant Task Orders.

The RER Team who have supported the Contract include the following six individuals:
e Program Manager
e Director, Credit Policy
e Sr. Business Analyst
e Sr. Business Analyst
e Quality Assurance/Tester

e Technology Innovations Manager

B. Request 2 (Documents indicating meeting attendance by RER)

Based on discussions with Committee staff, RER believes that its response to Request 1
above satisfies this request.

OF Request 3 (SBA’s Requirements, Specifications, or Guidance Regarding
Business Process Rules)

RER is producing a sample of its work plans and dashboards that were exchanged with the
SBA—often on a daily basis—which reflect communications between the Team and the SBA
about management of the application’s business process rules. Some of these work plans and
dashboards also are responsive to Request 4 (Fraud Checks) and Request 5 (Reports and updates
provided to the SBA).

In addition to these daily reports provided to the SBA, the Team has communicated
regularly with the SBA since the beginning of the COVID-19 Task Order in March 2020. At the
beginning of the COVID-19 Task Order, the Team and the SBA were conducting daily—and often
twice daily—phone calls to discuss performance, work plans, and status of new functionalities.
The Team continues to communicate with the SBA through regular phone calls.
KIRKLAND & ELLIS LLP

March 11, 2021
Page 6

D. Request 4 (Fraud Checks)

In its prior production, RER produced to the Committees a document from the Office of
Grants Management to the Chief Financial Officer of the SBA, which stated that the Small
Business Administration “contracted with RER Solutions for identity verification, data validation,
and fraud detection.” See RER_0000472. The letter also provided details on the SBA’s
requirements for processing of EIDL Applications as well as Fraud Check Indicators. Id.

In addition to this document, the Rapid and Rocket technical team provided a tour of the
Rapid Decision system to the Committees and their Staff on March 3, 2021. The Committee staffs
asked questions about the platform during the presentation. This interactive view of the system
provided additional responsive information to the Committees about the fraud checks in the
system. In addition, the daily dashboards produced show the work that the Team was doing
throughout the course of the project to add additional functionality to the system. These
dashboards provide additional information about the addition of new fraud checks to the system.

E. Request 5 (Reports and updates provided to the SBA)

RER is producing to the Committees daily reports provided to the SBA over a 60-day
period, which are described below. The Team began providing these reports to the SBA at various
times throughout the contract.

e Summary of COVID-19 Economic Injury Disaster Applications: A daily report of
rolling application intake data from March 29, 2020 through the report date. The first
slides show trend lines for various categories, including Count of Loan Applications
Submitted; Sum of Maximum Loan Potential; Count of Advance Applications
Submitted; and Loan and Advance Applications Submitted. The bulk of the report is
the "Summary Data," which is an inclusive chart that provides application data from
March 29, 2020 through the report date. It includes the number of applications per day,
sum of maximum loan potential, average loan potential, and other metrics related to
each application.

e Summary of COVID-19 Economic Injury Disaster Rapid Decision Submissions: A
daily report that includes advance and loan processing activity received on the COVID-
19 EIDL Application website. It includes summary data for loans and advances as of
the report date, including the number of requests submitted and number approved.

e SBA EIDL Loan Applications-Queues Snapshot: A daily spreadsheet that lists
multiple "Measured Action[s]," as well as the number of applications in that stage. For
example, one of the Measured Actions is "Applications waiting to be processed into
Rapid Decision." The stage is "In Intake." On February 10, 2021, there were 2,142
KIRKLAND & ELLIS LLP

March 11, 2021

Page 7

Applications waiting to be processed into Rapid Decision. The report also includes the
average number of days in the queue and the average percent of applications in the
queue for more than 10 days.

SBA EIDL Loan Applications-Throughput Last 24hrs: A daily spreadsheet that lists
multiple "Measured Action[s]" and the stage, as well as the Count for the past 24 hours.
For example, one of the "Measured Action[s]" is "Duplicate Applications." On
February 10, 2021, there were 8,621 duplicate applications, meaning applications that
have been determined to be submitted by the same applicant multiple times. The SBA
only considers the first application submitted by an applicant, and any duplicate request
is not considered. A record of all duplicate applications is maintained in the system.

SBA Work Plan-Rapid Program Work Dashboard: A daily dashboard that includes a
Targeted Intake Report, which provides statistics for the past 24 hours and for the
program to date. The Dashboard also includes Prioritization Backlog Items, Action
Items, Risks/Open Items, and Completed Items.

RER also provides a daily Processing Report/Fee Tracking Report to the SBA, which sets
forth information about the number of applications, advance decisions, loans with advance
decisions, loans without advance decisions, the number of co-applicants, and various fees.

A sample of one of the most recent Processing Reports, dated February 28, 2021, is below.

F.

Request 6 (Possible alert messages)

The Committees seek a “list of potential alert messages generated by the project’s loan
recommendation software and presented to SBA loan officers.” RER understands that Rapid has
provided the Committees with the most up-to-date list of these messages in its response to the
Committees requests. Any information RER might have would be duplicative of Rapid’s response.
KIRKLAND & ELLIS LLP

March 11, 2021
Page 8

V. Requests for Information

A. Revenue, Expenses, and Profit

RER previously provided the Committee with invoices from RER and Rocket to the SBA
from March 2020 through October 2020. In response to the Committees’ most recent request for
financial data, RER is producing invoices for it and Rocket from November 2020 through February
2021.

B. Fraud Checks on EIDL Applications

The Committees request “[a] complete list of all fraud checks conducted on EIDL
applications, and any documents demonstrating such fraud checks, including but not limited to any
Statements of Work and any other direction provided by SBA to RER.” The Committees also
sought this information in previous requests. RER previously provided a response to the
Committees’ requests for this information, see 11/25/2020 N. Eggleston Ltr. to Chairpersons and
Committee Members at 9—14, and repeats that response here. RER also produced a document that
showed fraud checks in the system. See RER_0000472. The Rapid and Rocket technical teams
have also provided the Committees with a tour of the Rapid Decision system, which demonstrated
the operation of the fraud controls in that system.

In addition to the information that RER has already provided to the Committees, RER
provides the following narrative description of the fraud checks in the system. RER also included
similar information in its November 25, 2020 letter. See 11/25/2020 N. Eggleston Ltr. to
Chairpersons and Committee Members at 9-14.

The Director of the SBA’s Office of Grants Management issued guidance to RER’s Chief
Financial Officer, Tami Perriello, on April 7, 2020. See RER_0000472. The guidance authorized
payments from RER Solutions, including the authority to issue EIDL Advances, up to $10,000,
subject to the procedures outlined in the memorandum. See id. The guidance explains that the
SBA contracted with RER for “identity verification, data validation, and fraud detection.” The
Office of Grants Management thus provided RER the following verification requirements and
fraud check indicators.

The verification checklist lists the verification checks required by the SBA Office of the
Chief Financial Officer, including:

1. EIDL applications collected through the Rapid Intake COVID-19 EIDL web form will
be forwarded for processing to Rapid Decision automated processing platform
configured and programmed in accordance with SBA Office of the Chief Financial
Officer requirements as follows:

2. Remove duplicates
KIRKLAND & ELLIS LLP

March 11, 2021
Page 9

3. Remove applicants previously funded under COVID-19 EIDL in
the Disaster Credit Management System (DCMS)

4, Perform fraud checks

5. Calculate eligible Advance amount based on logic provided by SBA

6. Applications that are not duplicates and not excluded based on fraud
rules will be periodically placed in a batch file including fields required
for processing through the Office of the Chief Financial Officer

7. Each batch file shall include batch number/code in the file name

Each batch file is sent to the Office of the Chief Financial Officer for

funds check and creation of a Payment Automation Manager (PAM)-

compliant file.

See id. (emphasis in original).

The Office of Grants Management guidance also listed the fraud check indicators. It
instructs that “[i]f any 1 of the BOLDED fraud indicators in the verification process are triggered
or any 3 BOLDED OR NON-BOLD indicators are triggered, the application will not be included
in a batch file.” These fraud check indicators include:

1. Large number of applications with other lenders (large scale)

2. Large number of applications for this program (several in succession)
3. Owner information failed validation (information does not match,
person is listed as deceased, etc.)

Client location is international

Digital identity fraud suspicion/suspicious online behavior — the data
has been used fraudulently online

VOIP phone number

Phone number is not associated with business or owner

Email has not passed validation

Invalid bank account number and/or routing number

10. Bank account ownership does not match business

11. Unable to confirm business registration

Id. at 1-2 (emphasis in original).

In accordance with these “streamlined procedures” and the CARES Act, the Director of
the Office of Grants Management “authorize[d] the disbursement of all records verified, validated,
[and] approved” from RER Solutions to the Office of the Chief Financial Officer. Jd. at 2.

Further, as outlined in the SBA’s Response letter to the OIG Report titled “Inspection of
Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus
Pandemic,” the SBA “leveraged technological solutions to add dozens of novel validations and
KIRKLAND & ELLIS LLP

March 11, 2021
Page 10

internal controls” to the COVID-19 related EIDL applications. See SBA Response to Inspection
Report at 50, https://www.sba.gov/sites/default/files/2020-11/SBA%2001IG%20Report%2021-
02.508.1.pdf. The SBA listed these system controls and validations in its Response, identifying
“controls that are new and in use specifically for COVID-19 EIDL” with an asterisk:

Data Validation & Controls:

Intake Application form field validations for correct data types and completeness
Intake form user input review prior to submission
Applicant data submission certification requirement
Identity information application velocity check*
Identity Information validation*

Email address validation*

Phone number validation*

User identity validation with out of wallet questions*
Public records lookups

Bank account data validation check*

Bank account ownership check*

IP address and device screening*

Credit report for score and fraud flags

System Decision Controls:

Duplicate application detection

Related application linking on multiple data attributes*

Red flag alerts for data attributes indicating potential for suspicious activity*
ODA Rule of Two requirement for loan approval

70+ business rules to determine business eligibility & loan/advance amounts*
Role-based approval restrictions

Role limited reconsideration workflow

User restricted failed disbursement processing

User action logging and notes updates

System Access and Workflow Controls:

Segmented Workflows with Role Access Limitations

Two-Factor Authentication

Multiple failed login attempt lockouts

IP Address velocity restrictions and blocking*

Bank account update access tokenization (Advance Reconsideration)*
KIRKLAND & ELLIS LLP

March 11, 2021
Page 11

Network & Application Security:

e Azure Front Door — MSFT threat intelligence and identification to guard against SQL
injection and other malicious hacking attempts
Azure — Network Security Group IP rules
Rapid Server Level Firewall Rules
Webroot Secure — Server level endpoint protection
Application level rules — IP blacklisting & whitelisting, User level behavioral blocking,
cross site scripting controls, permission based user access to only associated active
applications
e Data encryption at rest (MSFT TDE) and in transit (TLS 1.2)

Attack Mitigation and Security Monitoring:
e Azure Defender Security Center— Intrusion detection, vulnerability assessment and overall
environment monitoring
e Azure DDOS protection
OCIO Penetration Testing

Id. at 50-51. The SBA Response to the OIG Report also highlights “systematic enhancements”
that were added in response to “internal and external comments.” /d. at 70-71. These
enhancements are detailed in the SBA Response to the OIG Report and included in our November
25, 2020 letter to the Committees. See 11/25/2020 N. Eggleston Ltr. to Chairpersons and
Committee Members at 13.

On RER’s Assessment of Improper Payments

The Committees seek “RER’s assessment or estimate of the amount of improper payments
that have been made to applications who were processed through its loan recommendation
software.” This Request seeks a metric that RER does not track.

The RER-Rocket Team does track the number of rejected and duplicate loan applications.
As of February 28, 2021, 17,764,721 applications had been submitted to the Rapid Decision
system. The Rapid Decision system identified 5,260,601 of those applications as duplicates. Of
the 12,504,120 unique applications, 6,061,347 received a negative submission. 4,389,817 of those
applications were rejected because of credit score fails and ineligible submissions; 42,526 were
deemed automatically unqualified; and 1,629,004 applications were declined by the loan officer.

These numbers show that the rigorous controls applied in the Rapid Decision system,
together with the SBA loan officer review, have been working as designed. With 5,260,601
applications identified as duplicates and another 6,061,347 applications rejected, the EIDL
program has declined to obligate funds to the majority of the 17,000,000 applications SBA has
received.
KIRKLAND & ELLIS LLP

March 11, 2021
Page 12

D. Description of SBA’s Rules

The Committees seek a “description of SBA’s rules, specifications, and requirements for
how the loan software should classify applications for various recommendation queues.” RER
understands that the Committee also requested this information from Rapid Finance. Rapid
Finance has the most up-to-date and accurate set of rules, specifications, and requirements that the
SBA has provided for the loan software’s classification of applications for various
recommendation queues, and RER understands that Rapid Finance is producing this information
to the Committees.

Please note that this letter is labeled “Confidential.” The letter contains sensitive
commercial information related to RER’s current and/or future commercial operations. I
respectfully request that this information be treated as confidential and protected from disclosure
in accordance with all applicable laws and regulations, and that prior to any disclosure you provide
us with notice and an opportunity to assert any applicable privileges.

Thank you for the opportunity to provide information to the Committees on this important
matter.

Sincerely,

Enclosures


File and source

File

letter-counsel-rer-to-chairman-3-11-21-redacted-pdf_0d24e2eda5f4c1c0_wayback.pdf

Size

3,723,600 bytes

SHA-256

3cc96a933c8a516a91794394b630c1a146a03741e06549e6218f18c9c56bba28

Our copy

letter-counsel-rer-to-chairman-3-11-21-redacted-pdf_0d24e2eda5f4c1c0_wayback.pdf

Original

No public link identified.