Protecting the Integrity of the Pandemic Relief Programs: SBA's Actions to Prevent, Detect and Tackle Fraud (U.S. Small Business Administration, June 2023)
Summary
The U.S. Small Business Administration’s June 2023 report says the agency delivered $1.2 trillion in emergency grants and loans over two years, and estimates that $36 billion of it was likely obtained fraudulently, which SBA puts at 3% of disbursed funds. SBA says it flagged over $400 billion with indicators requiring further review, and that over 3.4 million human-led reviews cleared many of those flags. It attributes 86% of the fraud to the first nine months of the pandemic, when, it says, missteps weakened agency defenses. It credits the Biden-Harris Administration with PPP pre-approval screening, tax transcript verification for COVID-EIDL and Treasury Do Not Pay checks, and asks Congress to back the President’s proposal to give SBA OIG $100 Million to investigate.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Contents
Abstract ......................................................................................................................................................... 3
Executive Summary....................................................................................................................................... 4
Background ................................................................................................................................................. 10
Part 1: SBA in Action. How the Biden-Harris Administration Addressed Fraud ......................................... 12
Advancements in Fraud Detection through Technology ........................................................................ 12
Enhanced Risk Management Structures ................................................................................................. 16
Collaboration with Law Enforcement ..................................................................................................... 20
Part 2: SBA’s Continuing Role in Fraud Prevention..................................................................................... 23
Recommendations .................................................................................................................................. 24
Support the President’s Pandemic Anti-Fraud Proposal, Providing SBA OIG with $100 Million to
Investigate ........................................................................................................................................... 24
Future Program Design ....................................................................................................................... 25
Conclusion ................................................................................................................................................... 28
2
Abstract
In response to the historic threat posed to small businesses by the COVID-19 pandemic, the U.S. Small
Business Administration delivered an unprecedented $1.2 trillion in emergency grants and loans over
two years. That funding contributed to a historic economic recovery of 21 million lost private sector jobs
plus the attainment of 4 million more private sector jobs than ever existed before the pandemic.
The surge of funding also invited unprecedented fraud attacks against the agency, which was left
vulnerable by missteps that weakened agency defenses in the early months of the pandemic. This
report:
1. Estimates fraud levels in each of the four major SBA relief programs, 86% of which originated in
the first nine months of the pandemic.
2. Describes SBA’s actions under the Biden-Harris Administration to rebuild and strengthen anti-
fraud controls within the Paycheck Protection Program (PPP) and the COVID-19 Economic Injury
Disaster Loan (EIDL), both of which started in 2020 and continued into 2021. Those actions
include the initiation of SBA pre-approval screening for PPP, tax transcript verification for
COVID-EIDL, and Treasury Do Not Pay list validation for both.
3. Details how SBA learned from the mistakes of the 2020 implementation of PPP and COVID-EIDL
to design the two major relief programs that launched in 2021 — SVOG and RRF — which both
achieved estimated fraud rates of well below 1%.
4. Supports President Biden’s proposal for $1.6 billion in mandatory funding for law enforcement
in pursuit of government-wide pandemic fraud — and provides additional policy
recommendations to minimize fraud in future small business emergency relief programs.
3
Executive Summary
Three years after the onset of the historic COVID-19 pandemic, the U.S. unemployment rate is 3.7%, 1 a
near-record low for the modern era, and new businesses are forming at record rates. By any measure,
the nation’s small businesses have made a strong recovery. That recovery was made possible by an
unprecedented $5 trillion in federal emergency spending, one-fourth of which was delivered through
the U.S. Small Business Administration (SBA) in its four largest pandemic relief programs: the Paycheck
Protection Program (PPP) ($792 billion), COVID-19 Economic Injury Disaster Loan program (COVID-EIDL)
($405.2 billion), the Restaurant Revitalization Fund (RRF) ($28.6 billion), and the Shuttered Venue
Operators Grant Program (SVOG) ($14.6 billion). 2
As the SBA rapidly scaled to administer the pandemic relief programs in 2020, there were also
unprecedented fraud 3 attacks. Prior to 2020, the agency demonstrated a strong track record of
managing fraud risk in its core programs. For over a decade, independent auditors issued annual
financial statement audit opinions without any material weaknesses or findings. But in 2020, Congress
mandated quick implementation of the pandemic relief emergency programs — which, combined with a
lack of proper controls in some cases, enabled the attacks. Many of the existing controls and design
features in SBA’s longstanding disaster lending and loan guarantee programs that largely worked to
reduce fraud risks were removed in 2020. A failure to verify applicant data against existing federal
government databases, such as the U.S. Treasury Department’s Do Not Pay system, and a statutory bar
against obtaining and validating applications against tax records were two of the key missteps that took
place in 2020.
What is Fraud?
Fraud involves obtaining something of value through willful misrepresentation. Examples of fraud
include, but are not limited to:
• Forgery or alteration of documents,
• False financial reporting,
• Receipt of payment for services not performed, and
• Receipt of unearned benefits.
Analyses of fraud in pandemic programs use a variety of different terms to describe possible fraud.
The term potentially fraudulent is the broadest, including any grants or loans that have indicators of
suspicious or inconsistent behavior and require further review. This is an initial screening, similar to a
metal detector at an airport that may indicate something serious but often flags something benign. As
potentially fraudulent loans are analyzed and reviewed, often by staff with long prior careers
analyzing financial crime, they are determined to be either a false positive or likely fraudulent. Every
grant or loan SBA determines as likely fraudulent is referred to law enforcement. A grant or loan may
only be confirmed fraudulent through a criminal investigation. SBA’s program-wide estimates
reflected in this paper reflect the likely fraud standard.
To address these concerns, the Biden-Harris Administration, SBA Administrator Isabella Casillas Guzman,
and the dedicated employees of the SBA prioritized actions that restored longstanding anti-fraud
controls, put in place innovative new protections, and successfully reduced the potential for fraud,
4
waste, and abuse across SBA’s current and future programs. With a strong commitment from
Administrator Guzman and senior agency leadership to combat fraud, SBA has been actively engaged in
reducing the risk of fraud throughout the agency by improving operations and bolstering its risk
management systems. This report provides an overview of the tools, controls, and strategies deployed
by the SBA since January 2021 to prevent, detect, and respond to fraud risks identified in the COVID-19
pandemic relief programs it administered. Of note, the agency under the Biden-Harris Administration:
Drove Tangible Results in Fighting Fraud in Small Business Programs. SBA developed a dynamic anti-
fraud framework that limited fraud substantially, to a level far less than what could have occurred
otherwise. Across all four pandemic relief emergency programs, SBA:
• Screened 49.3 million applications using a combination of manual and automated controls, 4
triggering alerts on 6.7 million applications indicating the potential for fraud or ineligibility.
• Identified over $400 billion in applications, loans, grants, and awards that had indicators of potential
fraud requiring further investigation or review. This led to a deeper review to determine which of
these loans were in fact “likely fraudulent.”
• Conducted over 3.4 million human-led reviews of applications with fraud indicators or as part of a
random audit, and projects the agency will reach 3.75 million human-led reviews once complete.
• Projects that a total of 744,000 disbursed loans, grants, and awards and 2.46 million blocked
applications have been or will be referred by SBA to SBA’s Office of Inspector General (OIG) for likely
fraud. SBA identifies these referrals after a comprehensive automated screening, data analytics, and
human-led reviews of applications.
5
SBA’s Fraud Estimate Represents 3% of the $1.2 Trillion in Disbursed Emergency Relief Funds,
stemming largely from the first several months of the pandemic. While SBA identified over $400
billion with indicators that required additional review, analysis, or investigation, further investigation
of the flagged loans — including over 3.4 million human-led reviews — cleared many of the flags and
is expected to identify $36 billion of pandemic relief emergency program funds that were likely
obtained fraudulently. This amount reflects two groups of disbursed loans, grants, and awards: those
that SBA, after a complete internal review including a human-led review, suspects as likely fraudulent
and has already referred to OIG; and a portion of those that are still under review that SBA estimates,
based on prior review results, will be referred to OIG after human-led reviews are complete. Only after
lawful adjudication (through the court system or otherwise) can actual fraud be confirmed. All these
cases have been or will be brought to the attention of the Office of Inspector General for further
investigation and law enforcement action.
6
Moreover, SBA:
• Achieved dramatically lower fraud rates in the two large relief programs designed and launched
in 2021, SVOG and RRF. SBA estimates a fraud rate of one-third of one percent (0.33%) for
SVOG, and three-fourths of one percent (0.75%) for RRF.
• Blocked a total of 21.3 million applications from accessing pandemic relief programs,
representing $511 billion of funds retained. These included duplicate applications, ineligible
applications, and attempted fraud.
• Supported the investigations by several law enforcement agencies, including the U.S.
Department of Justice, the Federal Bureau of Investigation, and the U.S. Secret Service. As of
May 2023, there have been 1,011 indictments, 803 arrests and 526 convictions related to
COVID-EIDL and PPP. 5
• Aided the recovery of $30 billion from pandemic relief emergency programs as a result of law
enforcement actions, seizures, and voluntary repayments by borrowers and financial institution
returns. 6
Implemented an Innovative, Four-Part Anti-Fraud Control Framework to Prevent and Detect Fraud
across programs. Beginning in 2021, SBA implemented a four-part anti-fraud control framework across
all pandemic programs. It was applied retroactively to examine all 2020 PPP and COVID-EIDL loans and
used for all new applicants in 2021. For PPP, for example, this included screening all loans disbursed in
2021 prior to disbursement using automated checks for nineteen fraud indicators. For all programs, this
framework included both random and risk-based human-led reviews, leading to over 3.4 million human-
led reviews being performed across all programs.
Reinstated Checks using Treasury’s Do Not Pay System, to Make Sure That Businesses Applying for
COVID-EIDL or PPP Loans Existed. Policies implemented in 2020 allowed over 57,000 loans, worth $3.6
billion, to be disbursed to recipients in the Department of Treasury’s Do Not Pay system. Beginning in
2021, applications were subjected to pre-funding checks using information from the Do Not Pay system.
Loans that failed this compliance check did not receive approval unless the lender was able to resolve
the concern by obtaining sufficient documentation.
Used Tax Transcripts to Validate COVID-EIDL applicants. This change reversed course from 2020 and
ensured that SBA could use this basic anti-fraud control to verify applicants. This tool not only verifies a
business’s authenticity but also ensures the business is not overstating its pre-pandemic revenue to
obtain a loan larger than the one for which it is eligible.
7
Established a New Fraud Risk Management Board and Designated the first Special Counsel for
Enterprise Risk. To ensure the removal of basic anti-fraud controls that occurred in 2020 was not
replicated in the future, SBA established a new Fraud Risk Management Board (FRMB) — a designated
anti-fraud entity responsible for oversight and coordination of SBA’s fraud risk prevention, detection,
and response activities. The FRMB is composed of experienced agency executives across the SBA
enterprise. Furthermore, SBA’s General Counsel was designated to a new role as Special Counsel to
advise the Administrator on fraud and risk management activities across the Agency.
Received Positive Recognition by Oversight Bodies. These results have been recognized by both the
SBA Inspector General and the Pandemic Relief Accountability Committee (PRAC). SBA Inspector General
8
Mike Ware told Congress in a January 2022 hearing that “SBA is more prepared now than they've ever
been in terms of the control environment. [That] environment is stronger now than it's ever been and
certainly much stronger than what there was at the onset of the pandemic.” In March 2022, PRAC Chair
Michael Horowitz praised the collaborative efforts that brought together SBA, PRAC, OMB, and the SBA
IG to increase COVID-EIDL anti-fraud controls, testifying that this collaboration exhibited a model for
how to manage large-scale spending initiatives and balance the need for robust independent oversight
with timely implementation.” 7 And the GAO commended SBA’s 2021 RRF fraud framework, saying it
“reflects some leading practices described in GAO’s fraud risk framework” and identified numerous
improvements across SBA pandemic programs.
Anti-Fraud Recommendations
Under the Biden-Harris Administration and Administrator Guzman, the SBA has strengthened its
framework for identifying and reporting fraud and is committed to ensuring that lessons learned in
fraud management have an immediate as well as long-term impact on policy and program design. To
continue this critical prevention and enforcement work, this report concludes with recommendations to
further protect our nation’s small business assistance programs.
In the short term, funding investigations and law enforcement actions are a priority. President Biden
asked Congress to provide at least $100 million in mandatory funding to SBA’s OIG to fulfill the mission
laid out by recent legislation extending the statute of limitations for PPP and COVID-EIDL fraud. 8 That
requested funding is part of a broader, $1.6 billion government-wide proposal to combat fraud and
identity theft.
For the long term, SBA would encourage lawmakers to design emergency business relief programs with
a particular focus on program parameters that could further minimize fraud risk:
1. Expand government data-sharing. As outlined in President Biden’s Pandemic Anti-Fraud Proposal,
increasing access to government datasets, and expanding “yes” / “no” attribute validation services
would further SBA’s ability to prevent fraud on the front end. Grant SBA digital, real-time access to
government payroll data, as well as tax identification data, so that SBA can more quickly verify
applicant information.
2. Build now to save later. Establish the statutory framework in advance of an emergency, so that
agency personnel and procedures can move quickly and with a full range of controls in the event of a
crisis.
3. Consider the costs of fraud prevention measures. PPP origination fees to lenders were sizeable
(approximately $46 billion in fees as compared to the $1.5 billion appropriated to SBA to cover the
administrative costs of PPP and other pandemic relief program implementation). Future
programming could consider shifting administrative funding to the implementing agency, to enable
more agency loan reviews and additional fraud prevention measures, including human-led reviews.
4. Make the private sector part of the solution. With any approved administrative funding to lenders,
include stronger incentives or mandates for lenders to combat fraud, including by removing or
redesigning hold harmless provisions to ensure lenders have skin in the game when it comes to fraud
prevention and requiring measures to prevent, detect, and respond to fraud risks.
5. Prevent fraud rather than chase it. Center expectations on up-front fraud control measures
rather than on recovery efforts after funds are distributed, so that the post-disbursement stage
can better focus on applicant performance and ongoing monitoring.
9
Background
At the onset of the COVID-19 pandemic in the winter and early spring of 2020, our nation’s small
businesses faced massive disruption, forced to close their doors in response to public health orders and
left with uncertainty about the future. At the beginning of April, economic forecasts predicted a 38%
GDP drop in the second quarter, and the economy was shedding 700,000 jobs a month, the worst pace
since March 2009. 9 The Treasury Secretary predicted unemployment could reach 20%. 10 Between March
15 and April 4, one in 10 American workers filed for unemployment — eight times the previous high for
a period of that length. 11
This economic pain was concentrated among small businesses. Industries dominated by large
corporations — technology, pharmaceuticals, shipping, and energy — continued operating or, in some
cases, thrived. But industries led by small businesses — accommodation, food services, retail, arts, and
other services — were virtually shut down. And what was initially anticipated by many to be a two-
month economic hiatus followed by a return to normal was threatening to turn into a protracted
depression. By May 2020, the U.S. had lost 21 million private sector jobs, and public reports indicated
that as many as 40% of U.S. businesses had closed their doors, worrying policymakers that many might
not ever reopen. 12
A burst of federal relief and the on-and-off relaxation of public health measures brought a partial
recovery. But with a resurgence of the virus and federal relief slowing to a trickle, the recovery stalled,
with no meaningful job growth for three months, through January 2021.
President Biden was sworn in, and he appointed Administrator Guzman to lead the SBA. The Biden-
Harris Administration reinvigorated the SBA‘s pandemic relief emergency programs, bringing a new anti-
fraud focus and a strong emphasis on the smallest businesses hardest hit by the pandemic.
The two-year economic boom that followed was historic. New business formation accelerated, with 10.5
million new business applications in 2021 and 2022, a record high. 13 By April 2022, the U.S. surpassed its
pre-pandemic private sector jobs level, and the growth has continued. As of May 2023, the U.S. private
sector employed four million more workers than it ever did before the pandemic. Restaurant, travel,
and tourism businesses have come back, and service workers have seen their best real-wage growth in
decades. The American pandemic recovery has outpaced that of other advanced economies, and
experts attribute that success to the largest per-capita fiscal intervention in the world, one-fourth of
which was delivered through small business and nonprofit emergency programs at the U.S. Small
Business Administration.
The $1.2 trillion in SBA aid came in two waves: the first $742 billion, delivered mostly in mid-2020, was
broadly available to all small employers, regardless of sector or pandemic impact. In its delivery, speed
was the priority. The second wave, about $455 billion administered by the Biden-Harris Administration
from 2021 through mid-2022, was more targeted, favoring smaller entities, those with demonstrated
losses, operating in industries hit hard by the pandemic, or too small or disconnected from the banking
sector to have accessed relief in 2020. This second wave was effective for two reasons. First, the
Administration made critical choices in implementation, to push access to relief to the most struggling
and underserved small businesses. And second, it improved protections for the relief programs — which
had grown more numerous and complex — in detecting ineligible or fraudulent applicants in critical
ways that the 2020 implementation did not. This latter effort is the focus of this report: how SBA
10
strengthened pandemic relief emergency program fraud controls, the ongoing work at SBA to identify
and address pandemic-relief-related fraud, and lessons learned from both waves of pandemic relief.
Pandemic Relief Emergency Programs
In March 2020, Congress passed the CARES Act, creating the SBA’s Paycheck Protection Program (PPP)
and allocating additional funding to the COVID-19 Economic Injury Disaster Loan Program (COVID-
EIDL”). Congress tasked the SBA to help avoid an economic catastrophe: Provide businesses and
nonprofit organizations throughout the nation economic support by creating two new loan programs.
After successive rounds of funding, PPP delivered $792 billion in forgivable loans, up to $10 million per
entity. COVID-EIDL distributed $378 billion in low-interest loans up to $2 million and $27.2 billion in loan
advances to eligible businesses and nonprofit organizations.
As 2020 progressed, it became increasingly clear that these programs were attacked by fraudulent
actors. Public media reports as well as official government audits began to describe what appeared to be
a tremendous problem. They placed the blame on a lack of internal controls and oversight. Both the
Government Accountability Office (GAO) and OIG warned SBA of potential fraud in PPP and the need to
manage fraud risks. 14 The concerns appeared to relate to an insufficient control environment given the
scale of the pandemic relief programs, the speed at which funds were distributed, and the removal, by
statute and administrative actions, of key tools to verify applicant information and ensure the likelihood
of repayment. 15
Starting in December 2020, Congress passed additional measures to provide for pandemic-related
economic relief. The Economic Aid to Hard-Hit Small Businesses, Nonprofits and Venues Act of 2020
established the Shuttered Venue Operators Grant (“SVOG”) program, designed to assist the live
performing arts and entertainment industry. The American Rescue Plan Act of 2021 established both the
Restaurant Revitalization Fund (“RRF”), an award program designed to assist restaurants, bars, and
other similar places, and provided additional funding for the PPP and COVID-EIDL programs. Ultimately,
SBA administered four major pandemic relief programs: PPP, COVID-EIDL, RRF, and SVOG. Through
these programs, SBA administered $1.2 trillion to support small businesses and nonprofit organizations.
Since the beginning of the Biden-Harris Administration, SBA has been actively engaged and committed
to addressing these concerns, by improving operations and bolstering risk management systems. Part 1
of this report describes what the agency has accomplished and learned through improving upon and
implementing several pandemic relief programs since January 2021.
11
Part 1: SBA in Action. How the Biden-Harris Administration Addressed Fraud
The implementation of PPP and COVID-EIDL was expedited to quickly provide timely relief to mitigate
the economic impact of the COVID-19 pandemic. During 2020, the desire for the rapid deployment of
relief funds resulted in fewer fraud and eligibility controls up-front and at disbursement than what
normally occurred in SBA program operations. This approach increased the risk for funds to be
fraudulently obtained at origination, relying on the sufficiency of post-origination and post-
disbursement controls to identify and report instances of fraud and abuse.
Over the past two years, under Administrator Guzman’s leadership, the SBA has been proactive — both
enterprise-wide and program-specific — to address the concerns. Here are the highlights:
Advancements in Fraud Detection through Technology
SBA’s four-step approach to prevent and detect fraud begins with automated screening technology to
trigger an alert when an application met certain criteria potentially indicative of fraud, ineligibility, or
both. This technology raises an alert prompting the placement of a “flag” on an applicant or application
that would prevent funding of the loan, award, or grant. Higher-risk applications were prioritized and
inspected by human reviewers, by the lending organization (in the case of PPP), and at SBA, to confirm
or resolve initial flags. SBA deployed these up-front controls during the third round of PPP funding
(January 2021) and then deployed a similar approach in each of the pandemic relief programs. In
addition to using this approach as an up-front control, SBA also retroactively reviewed all loans
disbursed in 2020 using this process. Across all applications, loans, grants, and awards, SBA found over
$400 billion in potential fraud — 84% of which originated in 2020 — and placed flags on all files.
Subsequent reviews, including over 3.4 million human-led reviews, have cleared the majority of flags
while identifying an expected $36 billion in likely fraud — of which 86% originated in 2020. This graphic
gives an overview of the process:
Accomplishments To Date
The use of up-front controls produced an overall tangible impact in administering the pandemic relief
programs. SBA designed and created over 100 unique fraud and eligibility detection scenarios (referred
to as “Rules”) which triggered alerts (also referred to as “Hold Codes”). These rules were used to screen
49.3 million applications and alerted 6.7 million applications across SBA’s pandemic relief emergency
programs.
12
These results were also reflected in the automated fraud detection used in each of SBA’s pandemic
relief programs:
PPP (comprised of approximately 11.5 million disbursed loans totaling $792 billion)
Beginning in 2021, SBA implemented a new innovative anti-fraud control system: a combination of
alerts, enhanced front-end controls, and a machine-learning model that uses data from internal SBA
sources and private-sector databases to automatically determine which loans are the riskiest. All PPP
loans made under the Biden-Harris Administration had this level of screening before funds were
disbursed. The loans made under the previous Administration did not. Loans already disbursed in 2020
were subsequently assessed during the Biden-Harris Administration to identify those potentially
fraudulent loans. SBA performed an additional check to identify networks of potentially fraudulent PPP
loans, that when looked at individually, would not necessarily show indicia of fraud. In some instances,
SBA identified additional loans that were part of networks already known or partially known to law
enforcement but not previously identified.
SBA’s four-part anti-fraud framework used in PPP is described in more detail in Part 2 of this paper.
This work has produced results. After flagging 3.7 million loans with alerts and scrutinizing those loans
with the machine-learning model and subsequent human-led reviews, 188,000 loans totaling $6.7 billion
have been identified as likely fraudulent by SBA and referred to OIG for further law enforcement action.
SBA projects that when its PPP review is complete, a total of 223,000 loans totaling $7.4 billion will have
been referred to OIG.
Other key performance indicators include:
• In 2021, SBA prevented 174,000 potentially ineligible or fraudulent PPP applications from being
funded (after initially approved by lenders), representing $3.7 billion. This does not include
applications blocked by lenders, who were the first reviewers of all PPP loans.
• Identified 2,800 potential fraud networks, totaling almost $2 billion of taxpayer money. Using a
series of network analyses, the agency identified and analyzed relationships across loans,
borrowers, and lenders to identify potentially suspicious loan networks, relationships, and
activities. This process leverages learnings, data, patterns, and trends observed during reviews.
COVID-EIDL (comprised of approximately 10.5 million disbursed loans and loan advances totaling $405
billion)
Throughout 2021, SBA continually enhanced the COVID-EIDL control framework to prevent and detect
known weaknesses in the program. Control improvements included tools such as multi-factor
authentication; the use of tax transcripts; the use of the U.S. Treasury Department’s Do Not Pay system
(DNP); increased human contact for applicant verification; screens for known fraud indicators (such as
duplicate IP addresses); the use of automated tools for validation; and human-led reviews of
applications with fraud alerts.
This work has produced results: SBA screened 36.7 million entities and blocked 21.1 million from
receiving funding due to ineligibility, duplicate applications, or potential fraud. Out of the 3 million flags
generated from the automated screening tools and manual reviews deployed by the agency, SBA
13
referred, due to likely fraud, 2.46 million blocked COVID-EIDL applications and 520,000 funded loans and
loan advances to OIG for further investigation and law enforcement action. The 520,000 referred COVID-
EIDL loans and advances account for $28 billion in disbursements.
SBA checked this estimate using a second, independent method, analyzing COVID-EIDL repayment data,
and found both approaches indicate a similar scope of likely fraud in the program. One way that COVID-
EIDL participants demonstrate their authenticity is by beginning to repay their loans once they come
due. This is an observation that the SBA IG has made going back to 2022. 16 Now, after a long, 30-month
deferral period, a large majority of the loans by volume have entered the required repayment period.
SBA found that 74% of the COVID-EIDL portfolio has already made a payment, and SBA projects, based
on repayment data to date, that once all borrowers have entered repayment, 85.6% will make at least
one payment. Another 8.1%, SBA conservatively estimates based on past disasters, can be expected to
not make payments for non-fraud economic reasons, such as business closure. That leaves 6.3% of the
loan program, or about $24 billion in lending, which could be associated with a likelihood of fraud based
on this estimation method.
The fact that the COVID-EIDL program produced more screened applicants and made more referrals to
OIG than PPP comes as no surprise to the agency. First, although COVID-EIDL program disbursements
were approximately half of PPP dollars, the agency received three times as many applications within
COVID-EIDL than it did within PPP. This was because COVID-EIDL consisted of four distinct products: the
COVID-EIDL loan, the original Advance authorized by the CARES Act, the Targeted Advance, and the
Supplemental Advance; the three Advance products offered relatively small award amounts to a broad
universe of potential applicants, generating a large volume of applications. Another reason is that SBA,
as the lender, had to screen and approve applications for loans and loan advances, whereas PPP
required borrowers to apply with lenders, who screened applicants and only sent approved applications
to SBA. As a delegated loan program, lenders could deny PPP loan applications for potential fraud or
ineligibility. Conversely, SBA had to refer cases of likely fraud, regardless of whether an application is
funded, to OIG for further investigation and law enforcement. Lenders that suspected fraud in PPP
applications were directed to refer those cases to SBA’s OIG. Given the limited number of fraud controls
in the COVID-EIDL program during the previous Administration, the Biden-Harris Administration is proud
of the work that commenced in 2021 to prevent and reduce fraud risks in the program — as well as
identify wrongdoers — and refer them to OIG.
RRF (comprised of 101,000 awards totaling $28.6 billion)
Building on the lessons learned in PPP and COVID-EIDL, the RRF program had a control framework in
place upon its launch in 2021 and operationalized fraud risk management — resulting in just 0.75% of
loans being referred to OIG as likely fraud. GAO praised the extensive implementation plan that was
created through an interagency process to obtain feedback from internal and external stakeholders,
such as staff from other SBA offices, congressional committees, the Office of Management and Budget,
as well as recommendations from industry associations. GAO reported, in July 2022, “SBA’s emphasis on
automated, pre-award controls to prevent fraud reflects some leading practices described in GAO’s
fraud risk framework.” 17 RRF utilized robust third-party data validation tools from industry leaders
including IRS tax verification and DNP. SBA validated applicants’ information with third-party data
sources and limited applicants’ ability to modify their information after submission.
14
This work has produced results: These pre-award controls helped to detect and prevent 31,000
potentially ineligible or fraudulent award applications from being funded for $3 billion. SBA screened
294,000 entities and 118,000 award applications resulting in 9,000 flagged applications with fraud alerts.
Of those, SBA determined, after human-led reviews, that 720 awards representing $215 million in
funding merited referral as likely fraudulent to OIG. This likely fraud referral rate, representing just
0.75% of the total loan value, shows the effectiveness of up-front controls when implemented at the
onset of a program.
SVOG (comprised of 13,000 grants totaling $14.6 billion)
Like RRF, SVOG implemented similar up-front controls to include IRS tax verification, DNP, as well as
cross checks with other government and private-sector databases 18 before executing disbursements.
SBA screened over 17,600 entities, resulting in less than 600 flagged applications with fraud alerts. Of
the 13,000 grantees, 17 were referred to OIG, representing $48.5 million. Out of the over 4,600
applications that were blocked, 248 were referred to OIG — meaning just 0.33% of all disbursed funds
were referred to OIG as likely fraudulent. These results withstood scrutiny: No significant weaknesses
were found in the testing of internal controls by external auditors. Pre-award control activities reflected
some GAO Fraud Risk Framework best practices related to developing an antifraud strategy.
The agency is proud that RRF and SVOG, programs fully implemented under the Biden-Harris
Administration, had instances of likely fraud totaling less than 1% of disbursed awards and grants in
those programs. This small amount proves the success of anti-fraud controls in SBA programs. The
following chart depicts the anti-fraud controls deployed by the agency in each of the small business
emergency relief programs:
15
Enhanced Risk Management Structures
A Dedicated Anti-Fraud Entity
At the beginning of the Biden-Harris Administration, SBA managed fraud risk primarily at the program
office level. SBA offices responsible for managing particular programs, such as disaster lending or loan
guarantees, were primarily responsible for maintaining an appropriate level of controls. Throughout the
history of the SBA, this strategy for preventing fraud risks worked. SBA’s longstanding disaster lending
and loan guarantee programs, which had the largest financial exposure, had controls (such as borrower
tax return information) and design features (such as lenders that determine eligibility) that largely
worked to reduce fraud risks to lower levels. Moreover, prior to FY2020, SBA had a solid record of
unmodified financial statement audits, with no material weakness in internal controls and no findings
16
related to fraud risk management. However, the COVID-19 pandemic relief programs introduced a step-
change in the agency’s fraud risk exposure.
Under Administrator Guzman’s leadership, SBA quickly recognized that its existing infrastructure was
not sufficient to manage the risks presented by the COVID-19 pandemic relief programs and responded
by organizing new oversight mechanisms. To better manage the growing concerns related to potential
fraud in SBA’s portfolio and to better align with best practices identified in GAO’s Fraud Risk
Management Framework, 19 SBA established the Fraud Risk Management Board (FRMB) at the beginning
of 2022. Under this structure, the FRMB provides high-level, agency-wide oversight of fraud risk
management, deploying senior career officials at the level of Deputy Associate Administrator (DAA) or
equivalent seniority. The FRMB serves as SBA’s designated Anti-Fraud Entity and as such, is responsible
for agency-wide fraud risk management, guidance, the issuance of SBA agency-wide fraud risk
governance policies, and supporting agency-wide oversight of fraud prevention, detection, and response
strategies. Offices within SBA rely on this guidance and materials to supplement the program controls
they design.
Notable enhancements to risk management
In addition to creating a dedicated anti-fraud entity, the agency has:
• Established an inaugural Special Counsel for Enterprise Risk. The Administrator designated the
agency’s then-General Counsel to advise her on risk management activities enterprise-wide,
focusing on fraud in pandemic relief programs as well as potential fraud exposure as a top
priority.
• Conducted formal Fraud Risk Assessments for all pandemic relief programs. These assessments
and related fraud risk mitigation plans respond to and reduce fraud risks that lay beyond the
agency’s accepted risk tolerance levels.
• Adopted four major principles concerning fraud risk management:
• Tone at the Top. To ensure that senior leadership is appropriately focused and accountable
for fraud risk mitigation.
• Ongoing Monitoring. To ensure that fraud risk management is executed consistently and
effectively across the agency.
• Training. To ensure that SBA personnel are aware of fraud risk vulnerabilities and responses.
• Innovative Technology Solutions. To ensure that current technology is used to identify,
assess, and mitigate potential fraud risks.
• Applied Data Analytics. SBA partnered with a global management technology and risk consulting
firm to leverage several data analytics methods to review the PPP loan portfolio with the intent
of managing fraud risks by reducing false positives, prioritizing identified fraud typologies and
behaviors, as well as uncovering areas of fraud risk not previously known. SBA began the use of
data analytics to enable the monitoring of transactional outliers, trends, and emerging
vulnerabilities in both PPP and COVID-EIDL. Developed and implemented portfolio-level data
analytics across the COVID-EIDL program loans and advances to detect potentially ineligible and
fraudulent applications.
• Standardized Data Analytics Reporting Across Programs. SBA launched a standardized data
analytics program to help identify potentially ineligible and fraudulent loans, grants, or
recipients across multiple SBA programs.
17
• Enhanced Safeguards for COVID-EIDL in Consultation with PRAC and GAO. Prior to the increase
of the COVID-EIDL cap to $2 million in September 2021, SBA worked closely in consultation with
the PRAC and GAO to carefully review new fraud controls that should be put in place. This
consultation and review led to SBA taking the following additional steps:
• Strengthened “economic needs” and “cashflow sufficiency” tests.
• Required additional documentation of borrower performance.
• Increased protections for the government against borrower default, including by requiring
personal guarantees and increased collateral requirements for larger loans.
• Flagged suspicious foreign IP addresses.
Improvements to Operations
Implementation of GAO and OIG Recommendations
Under the Biden-Harris Administration, SBA’s program offices responded fully to fraud risks by
expeditiously implementing controls and measures recommended by GAO and SBA’s OIG. Both have
positively recognized SBA’s work under Administrator Guzman’s leadership to enhance fraud controls in
pandemic relief programs. The agency continues to work aggressively to implement the
recommendations in the audits related to all the pandemic relief programs.
In response to specific GAO recommendations, the agency has:
• Fully implemented most of the high-priority fraud risk recommendations. In several reports
from GAO concerning fraud risks in PPP and COVID-EIDL, the agency implemented six out of
eight recommendations and has substantially completed the remainder to help ensure program
integrity, achieve program effectiveness, and address potential fraud. 20 SBA executed the fraud-
related recommendations within 18 months of issuance. Agencies are commonly given four
years to implement GAO recommendations.
• Maintained an appropriate improper payments rate. SBA estimated the rate of improper
payments consistent with the requirements of the Payment Integrity Information Act of 2019
(PIIA) with a rate well below the statutory threshold of 10%. A payment is deemed “improper” if
it was made in an incorrect amount, either more or less than the approved amount, or to an
incorrect or ineligible recipient. 21
• Created a multi-year Fraud Risk Management Strategic Plan. The agency’s Fraud Risk
Management Board implemented a strategic plan designed to implement and sustain a mature
fraud risk management program that encompasses GAO’s fraud risk management framework,
federal government best practices, and professional standards in fraud and enterprise risk
management as well as internal controls. With a mission to optimize financial resources by
minimizing fraud in agency programs and operations, the strategic plan leverages seven core
elements: Governance and Tone at the Top, Fraud Risk Assessments, Effective Internal Controls,
Fraud Identification, Investigation and Corrective Actions, Fraud Risk Monitoring, Enterprise-
Wide Fraud Risk Knowledge and Capabilities, and Fraud Reporting and Management.
Similarly, SBA has already made great strides in improving its operations by implementing several OIG
recommendations related to COVID-EIDL fraud concerns:
18
• Canceled all ineligible loans that were not disbursed, recovered funds from loans disbursed to
ineligible applicants, and flagged those loans for the improper payments estimation process.
• Formalized a process to restore identity theft victims to their condition prior to the fraud. The
process includes steps to stop the loan billing statements, prevent delinquency collections, and
release victims from loan liability and UCC liens.
• Performed a thorough review of the COVID-EIDL portfolio and determined which transactions
were made to ineligible recipients and were not in conformance with the CARES Act or related
legislation.
• Implemented pre-payment and pre-award procedures — including the use of batch match and
continuous monitoring functions available in the Treasury’s DNP system — to identify
potentially ineligible applicants before disbursing COVID-EIDL program funds.
SBA continues to work with OIG to address the remaining open recommendations. As reported by the
OIG, Congress mandated SBA to swiftly disburse funds to millions of struggling small businesses. While
basic anti-fraud controls were removed in 2020, in favor of speed, reflecting on the current state of
SBA’s fraud risk management, OIG stated that “SBA has since implemented fraud and eligibility controls
and taken corrective actions to combat PPP fraud.” 22
Additional Fraud Detection, Prevention, and Response Measures
SBA has put in place additional fraud-detection measures, establishing a multi-layered strategy for
preventing, detecting, and responding to fraud in the pandemic relief programs:
Enhanced Anti-Fraud Detection Teams
• Dramatically Scaled Its Anti-Fraud Teams From 2 to 280 Full-Time Employees. In response to the
unprecedented influx of potential and confirmed identity theft cases in 2020, associated with
loan applications for pandemic relief programs, SBA scaled its anti-fraud review teams from 2
full-time employees to 280.
• Developed a Human-Led Review Process. SBA conducted more than 3.4 million human-led
reviews of applications and loans that had been determined through a combination of
automated screening, data analytics, and in the case of PPP, machine learning, to present a
heightened risk of fraud or ineligibility. If after investigation fraud or ineligibility seem likely,
these applications and loans are referred to the SBA Office of Inspector General for further
action. Loans that have been approved and funded are also subject to human-led review if
indicia of fraud or ineligibility are later detected.
• Improved Lender and Loan Agent Oversight. In December 2022, the House Select Subcommittee
on the Coronavirus Crisis reported on fraud in PPP. The report focused on the lenders, their
third-party vendors, and other participants in SBA’s lending program who appeared to have
actively engaged in fraud, facilitating a disproportionately high rate of fraudulent and otherwise
ineligible loans. The report found that certain companies and individuals observed significant
fraud, but evaded responsibility. SBA took swift action in response to the report, suspending
certain actors from working with SBA in any capacity in the future and launching a full
investigation of the lenders and other related entities named in the report. Moreover, in FY
2021, SBA improved its operations and realigned its governance structure to strengthen lender
oversight and added resources for more effective oversight.
19
Improved Public Engagement
• Enhanced SBA’s Fraud Prevention and Reporting Protocols. SBA’s “Preventing Fraud and Identity
Theft” webpage emphasized the agency’s focus on fraud and provided resources for the public
on the agency’s actions against fraud. Importantly, this page was designed to provide
information to small business owners and lenders on how they can work with the SBA to
prevent and report potential fraud. Those resources can be found at sba.gov/fraud.
Improved Victim Resources
• Enhanced SBA’s Identity Theft Protocols. In response to the unprecedented demand for
addressing victims of identity theft inherited from 2020, SBA has put in place a system that
allows victims of identity theft to seek to have their names cleared and ensure they are not held
financially liable. SBA created dedicated teams to quickly support PPP and COVID-EIDL recipients
with the filing and processing of identity-theft complaints. These teams work diligently to ensure
victims’ fraudulently obtained loan debts are released. Where identity theft is confirmed, SBA
acts to protect victims, including coordinating with third parties to prevent billing or collections.
• Improved Identity Theft Victim Services. Recognizing the increased risk for identity theft in the
pandemic relief programs 23, SBA improved services for victims of identity theft to complete the
necessary steps to fully resolve the fraudulent use of their information. Victims can go to
sba.gov/IDtheft for assistance.
Collaboration with Law Enforcement
SBA continues to work with the OIG and the U.S. Department of Justice (DOJ) on actions related to
potentially fraudulent recipients of federal funds. In PPP, SBA receives numerous, but not all, reports of
fraud from lenders. When SBA receives such reports, SBA flags the individual loans for further analysis
and/or law enforcement investigation. SBA similarly flags individual loans the Agency is made aware of
that were identified through fraud referrals received from OIG and DOJ.
In connection with the enactment of the CARES Act, Congress also established the Pandemic Response
Accountability Committee (PRAC). This group of 21 Inspectors General uses data to detect and combat
fraud, waste, and abuse as well as mismanagement of any pandemic-related programs and funding.
Working collaboratively with the PRAC, SBA has been able to reinforce its own fraud risk management
efforts. In one example of this collaboration, the PRAC assisted in identifying fraud patterns and
networks that extend beyond SBA’s ability to prevent and detect. 24
SBA successfully leveraged hundreds of investigators and lawyers from multiple agencies to assist in the
investigation and pursuit of COVID-EIDL loan fraud cases. When SBA identifies cases of potential fraud or
identity theft, the COVID-EIDL fraud review team refers the case to the OIG for possible criminal
investigation. The fraud review team also provides support to the OIG, Department of Justice, U.S.
Secret Service, and other law enforcement agencies investigating and prosecuting cases of fraud. As a
result of SBA’s close collaboration with the OIG and our nationwide reviews of fraud patterns and cases,
SBA and OIG have been able to identify and track systemic patterns of fraud in the COVID-related loan
programs.
20
To date, SBA has leveraged its close working relationship with the United States Secret Service (USSS)
Special Agent in Charge (SAC) responsible for COVID-related issues, to enable USSS to seize $1.1 billion
in fraudulently obtained funds. Many of these funds were collected through voluntary turnovers as
opposed to judicial action. In addition, as of March 2023, $460 million had been recovered through
Department of Justice-led indictments and convictions, $8 billion has been returned by financial
institutions and $20 billion has been returned by borrower voluntary repayment. In May 2023, total
recoveries from the pandemic relief emergency programs had reached $30 billion.
Estimating Fraud
Many of SBA’s external stakeholders have asked how much fraud there is in the $1.2 trillion of SBA
pandemic aid. SBA recognizes the importance of understanding the degree to which participants in
critical emergency funding misled the federal government and stole taxpayer dollars. To date, the
federal government has not developed an accepted methodology for estimating fraud in federal
programs. 25 In a recent report, GAO underscored the difficulty of producing a fraud estimate in federal
programs given varying definitions, imperfect detection and reporting, and insufficient data. 26
Notwithstanding the difficulties, SBA conducted a comprehensive analysis and calculated an estimated
$36 billion in fraud to date, reflecting the value of 744,000 million in loans, grants, and awards
distributed to pandemic relief program recipients. Of this amount, SBA estimates $31 billion — or 86%
— is associated with applications that originated in 2020, and the remaining 14% with applications from
2021 and 2022. As reflected in the graphic below, the agency estimates that the likely fraud in small
business emergency relief programs is the value of loans, grants, and awards referred to, or expected to
be referred to, OIG for law enforcement action. The process by which the agency identified likely fraud
began with the automated screening process, which flagged over $400 billion in applications, loans,
grants, and awards with data anomalies. Then, SBA deployed a combination of advanced data analytics,
machine learning (in the case of PPP), and over 3.4 million manual, human-led investigations to arrive at
a population of loans, grants, and awards that could be referred to OIG with a strong belief of likely
fraud, supported by detailed and documented investigation.
21
22
Part 2: SBA’s Continuing Role in Fraud Prevention
SBA’s critical role in the nation’s economy, supporting a strong ecosystem for small business and
entrepreneurship, as well as its role in helping businesses and communities recover from disasters,
demands that SBA consistently remain a good steward of taxpayer dollars.
SBA will work diligently to continuously combat fraud and reduce fraud risks in SBA programs. Efforts
include:
• Continuously monitoring and improving SBA’s fraud controls to respond to the ever-changing
fraud risk environment. One of the lessons learned from 2020 is that the removal of certain
controls (even at the direction of specific legislation) to prioritize the speed of program
implementation and execution must be managed and monitored continuously for fraud risks.
The implementation of up-front, automated fraud controls is key to that strategy.
• Improving data analytics capabilities. The use of data analytics across an entire portfolio helps
identify potential signs of fraud for teams to further research. Sharing data across programs can
better facilitate fraud detection. SBA is also investing in technology that will enable additional,
automated fraud screenings for all loan programs using third-party data sources.
• Ongoing oversight of program fraud risks. With the creation of a dedicated entity to lead fraud
risk management activities, SBA has established the structure necessary to oversee fraud risk
management activities enterprise-wide. In carrying out its role, the FRMB can serve as a
repository of knowledge on fraud risks and controls, can manage the fraud risk assessment
process, can assist with trainings and other fraud awareness activities, and can coordinate anti-
fraud initiatives across all of SBA’s programs. Much of this work has already commenced.
• Engaging in data sharing with other federal agencies. Interagency collaboration is important for
sharing best practices related to fraud prevention and data analytics. Examples include:
o As previously advised by the PRAC, SBA has engaged with the Social Security
Administration in order to verify Social Security Numbers (SSNs) directly with the
agency, as an improvement or complement to the use of third-party sources for SSN
verification. SSA has not granted SBA access to date, but the agencies are in dialogue
about the possibility; ultimately, legislation may be necessary.
o The SBA worked closely with the IRS to verify tax data for pandemic programs beginning
in 2021. However, modernized approaches to data sharing, such as the use of APIs,
would significantly increase the speed of data exchange and decrease manual errors in
the process.
o Another data source that the agency would like to evaluate is the National Directory of
New Hires (NDNH) maintained by the Department of Health and Human Services, which
reflects unemployment taxes paid by employers to State Workforce Agencies. New
legislation is required to grant SBA access.
• Researching additional methods and determining best practices and funding sources for
recovery of fraudulently obtained federal funds, as well as seeking additional administrative
funding resources to assist with ongoing servicing and post-award monitoring.
These efforts work to ensure that SBA’s current programs do not face the fraud risks that beset
PPP and COVID-EIDL as they were launched in 2020.
23
Recommendations
The federal economic response to the COVID-19 pandemic was extraordinary and unprecedented in size
and speed. While public health officials prepared for pandemics, few policymakers contemplated or
prepared for a policy response to a total shutdown of the economy and the ongoing struggle for families
and businesses brought about by the pandemic and the necessary public health measures that came
with it. It would be a mistake not to take the opportunity to learn from the experience and prepare for a
similar national economic crisis. In the spirit of that effort, SBA is providing recommendations to
policymakers below — both on how to continue fighting fraud in economic relief programs and on how
to design similar aid in the future that is less susceptible to fraud.
Support the President’s Pandemic Anti-Fraud Proposal, Providing SBA OIG with $100 Million to
Investigate
Anti-fraud enforcement has generated successful results and financial returns for the public. SBA’s OIG
investigations of its pandemic loan programs had resulted in 1,011 indictments, 803 arrests, and 529
convictions as of May 2023, and their collaboration with federal law enforcement agencies combined
with returns from financial institutions has resulted in $30 billion in COVID-EIDL and PPP funds being
seized or returned to SBA.
SBA has identified more cases of potential or likely fraud than law enforcement can handle. About
744,000 cases of likely fraud from approved awards, grants, and loans have been referred, or likely will
be referred, to OIG across pandemic programs. All of these are reported to the SBA’s Office of Inspector
General, who then must decide how to allocate their own scarce resources. The OIG has repeatedly and
publicly indicated that the office is overstretched. Deputy Inspector General Shoemaker told Congress
in March 2023 that the office had over 80,000 actionable leads, but only 550 open cases across both
PPP and COVID-EIDL. 27
In early 2022, Congress and President Biden demonstrated their commitment to pandemic fraud
accountability by passing into law the “PPP and Bank Fraud Enforcement Harmonization Act of 2022,”
which extends from 5 to 10 years the statute of limitations for PPP fraud. Now that law enforcement has
the time and leads available to hold fraudsters accountable, Congress has begun to fund the mission. In
the Fiscal Year 2023 Omnibus passed at the end of December 2022, Congress provided $32 million to
OIG, a 41% increase above its prior-year level. That is notable progress.
However, more resources for law enforcement are still needed. SBA’s COVID-19 programs were three
times the size of the 2009 Troubled Asset Relief Program (TARP) and significantly more complex, but the
SBA OIG funding has been significantly less than the OIG funding Congress provided for TARP. 28
Continued increases in annual appropriations for OIG will enable the office to enhance its data analytics
unit and hire more permanent investigative personnel.
OIG is also operating on supplemental funding associated with pandemic programs, that allowed a
temporary staffing increase of 51 positions. However, this funding is winding down. OIG now expects to
use up the remainder of its $50 million in pandemic supplemental funding near the conclusion of FY
2024, well before the end of the statute of limitations for PPP fraud. 29
On March 1, 2023, President Biden released his $1.6 billion Pandemic Anti-Fraud proposal, which
proposes at least $100 million in new mandatory funding for SBA OIG to expand its capacity and extend
24
the pandemic-focused personnel surge. This would complement the additional $15.7 million funding
increase called for in the President’s FY 2024 budget request. OIG’s investigative work to date has
returned billions of dollars on a limited budget; it’s reasonable that additional resources would bring
additional returns to recoup what the federal government has lost to fraudsters.
Along with increased funding for SBA OIG, the President’s proposal also highlights critical policy
enhancements that would allow SBA to prevent fraud before it happens. These enhancements include
expanding access to government datasets, such as Treasury’s Do Not Pay and IRS Tax Transcripts, and
increasing privacy-preserving “yes” / “no” attribute validation services.
Future Program Design
Lessons learned from the COVID-19 SBA programs provide an opportunity to consider design choices for
future small business emergency programs. The purpose of the recommendations that follow is not to
argue in favor of one framework or another, or to comment on distributional tradeoffs in the program.
Rather, it is to identify program features for consideration, if large-scale small business grants, loans, or
hybrid programs are to be considered again in the event of another pandemic or other national
economic emergency. The recommendations are:
1. Expand government data-sharing. 30 IRS holds the gold-standard data for business verification.
However, today, IRS tax data is only available to SBA for limited program use and by request (a
process that often takes a week or longer), relying on an old form of technology and requiring
human-conducted reviews by both the SBA and IRS. In the CARES Act, Congress initially barred
SBA from using IRS tax data in administering COVID-EIDL, a long-standing agency practice for
mitigating fraud and determining eligibility, to facilitate quick delivery of pandemic relief funds
to needy businesses. SBA was subsequently granted the authority and used IRS data starting in
2021 to verify identity for its pandemic programs, notably doing so for COVID-EIDL, RRF, and
SVOG. 31 Once established, the use of IRS tax data was highly successful in denying loans to
ineligible and fraudulent applicants.
Using IRS payroll and tax identification data in future programs comes with an expectation of
faster processing so that relief can be provided timely. A faster, more modern payroll
verification would be necessary to achieve the goals of speedy distribution and reduced fraud.
Fortunately, a model already exists for other federal agencies having direct access to IRS tax
data. Notably, Congress granted the authority to the Department of Education for its Federal
Student Loan program. Extending the same authority to SBA could enable a real-time
application programming interface (API), such that SBA could instantly verify an applicant’s
stated payroll level from the prior year. This feature would allow SBA to verify all the applicant-
provided payroll information necessary to compute the eligible loan amount. Facilitating the
sharing of government-collected information between federal agencies would reduce the fraud
risks inherent in government programs. 32 Several pandemic programs used objective business
financial data (for example, payroll expenses and business income) to calculate an appropriate
loan or grant amount. Because SBA does not have access to this information, applicants were
required to provide it as part of their application or retain it to support self-certification of
eligibility. Instead of requiring a substantial amount of financial data and burdening agencies
with verifying complex transactions such as payroll expenses, Congress could base eligibility
25
and loan amount on objective, pre-existing tax data, such as a desired percentage of Social
Security- or Medicare-covered wages reported to IRS in the previous tax year or quarter.
2. Build now to save later. Permanent emergency relief programs are standard throughout the
government. FEMA, the SBA, and numerous other agencies are permanently authorized to assist
in the event of hurricanes, floods, earthquakes, and other natural disasters. Congress often must
provide emergency appropriations to fund those relief efforts, but permanent authorization
enables program rules, agency personnel, and procedures to be in place and move quickly to
deliver relief once appropriations are available. If lawmakers believe that an emergency
forgivable loan program would be prudent in the event of a future nationwide economic
emergency, Congress should consider creating permanent authorization for this program as
well. With a relatively minimal administrative investment, such a statute would enable the SBA
to establish rules, regulations, and systems inclusive of robust fraud control measures — which
would resemble the 2021 third round of PPP, as opposed to the version stood up in one week by
the CARES Act in April 2020. Congress could take this action with minimal budgetary cost and
postpone the decision on how substantially to finance the program until a future economic
emergency arises. A permanent framework could also be established for any of SBA’s pandemic
relief programs should Congress so desire to execute them in the event of a national emergency.
3. Consider the costs of fraud prevention. Congress delegated most of the administration of PPP
to program lenders, as demonstrated by the authority vested in lenders to directly approve
loans, and to the extent they were resourced, relative to SBA. Over the course of PPP, Congress
paid lenders more than $46 billion in origination fees, more than 30 times the $1.5 billion in
administrative dollars appropriated to SBA over three years to cover PPP and other pandemic
relief programs. For a nearly $800 billion program, SBA’s administrative funding was historically
small, representing less than two-tenths of 1% (0.2%).
In contrast, SBA core programs typically receive about 10-15% of program costs in the form of
administrative oversight funding. From the standpoint of fraud mitigation, the lenders played an
important frontline role — their performance of Know Your Customer and Bank Secrecy Act
procedures was vital — but critical tools such as third-party data checks by their nature must be
centralized at SBA. The same is true for standardized human-led reviews for the purpose of
improper payments analysis, for example. Future programming could consider shifting
administrative funding to the implementing agency to enable more agency loan reviews and
additional fraud prevention measures, including human-led reviews.
4. Make the private sector part of the solution. Two statutory features of PPP combined to
substantially minimize the incentive for lenders to deter and weed out fraudulent applications:
(1) the 100% loan guarantee provided, and (2) the requirement that SBA hold lenders harmless
for false certifications made by borrowers. As reported by the House Select Committee on the
Coronavirus Crisis, the combination of these two features led to some lenders bypassing fraud
controls as they rushed to approve as many loans as possible. 33 Removing, or at least
redesigning, the hold harmless provision to ensure that lenders have skin in the game would
strengthen their resolve to fully participate in fraud prevention.
26
5. Prevent fraud rather than chase it. In the case of PPP, Congress authorized a forgivable loan
program for the reason advertised in the program’s name: to incentivize businesses to retain
workers and keep them on the payroll. As this report has detailed, millions of loans were quickly
funded without critical, pre-disbursement screening. As the program developed and after
millions of loans had been disbursed, Administration officials in 2020 indicated publicly that the
forgiveness process would be used to identify ineligible participants and claw back funds. Fraud
controls must be pushed to the front end, at the time of application and before disbursement,
to the greatest extent possible. Ongoing fraud controls can and should continue post-
origination, but these should be to complement — not substitute for — upfront screening.
27
Conclusion
The door closed to SBA pandemic emergency relief one year ago, but the work to administer the
programs continues. Under Administrator Guzman, the agency continues to prioritize serving small
businesses in loan repayment, forgiveness, or grant reporting and compliance. The agency also
continues to prioritize identifying fraud and ineligibility across the pandemic programs and remains in
close partnership with law enforcement to hold accountable those individuals who stole from the
taxpayer, small businesses and nonprofit organizations rightfully eligible for assistance. This work will
continue for years. But this continued work should not stop policymakers across the Federal
Government from assessing the strengths and weaknesses of the COVID-19 response for small
businesses — and using those learnings to improve both permanent federal programming and any
emergency assistance that may be deployed in response to a future emergency. SBA is eager to partner
with other agencies and Congress in pursuit of those goals.
###
28
1
U.S. Bureau of Labor Statistics. The Employment Situation news release for May 2023.
https://www.bls.gov/charts/employment-situation/civilian-unemployment-rate.htm
2
Numbers in parentheses reflect net distributed funding as of March 2023. Unless otherwise noted, all other
figures are rounded to the nearest 100,000, current as of April 2023 and are subject to change as SBA continues its
fraud fighting work.
3
Fraud involves obtaining something of value through willful misrepresentation, which is determined through a
court or other adjudicative systems. See: U.S. Government Accountability Office. Fraud in the Federal Government,
p. 1. January 2023. https://www.gao.gov/assets/gao-23-106110.pdf. References to potential fraud reflect when
fraud is suspected, but not yet confirmed, determined, or proven. See: U.S. Government Accountability Office, A
Framework for Managing Fraud Risks in Federal Programs, July 2015. https://www.gao.gov/assets/gao-15-
593sp.pdf (GAO Fraud Framework 2015).
4
SBA screened affiliated entities/individuals through government and commercial databases for SVOG manually,
while PPP, COVID-EIDL, and RRF screening was automated.
5
Provided to SBA by Office of Inspector General.
6
U.S. Small Business Administration, Office of Inspector General. Testimony of Deputy Inspector General Sheldon
Shoemaker before the U.S. House of Representatives Subcommittee on Government Operations and the Federal
Workforce. March 9, 2023. https://content.stage.sba.gov/article/2023/mar/13/testimony-deputy-inspector-
general-sheldon-shoemaker-us-house-representatives-
subcommittee#:~:text=Testimony%20of%20Deputy%20Inspector%20General%20Sheldon%20Shoemaker%20befor
e,Subcommittee%20on%20Government%20Operations%20and%20the%20Federal%20Workforce. At time of
testimony, $29.1 billion reflected $1.1 billion seized by U.S. Secret Service, $8 billion returned by borrowers and
$20 billion returned by financial institutions in the COVID-EIDL program. OIG updated the total to $30 billion in
June 2023.
7
In Congressional testimony, PRAC Chair Michael Horowitz wrote about the importance of this collaborative
process between the Biden-Harris Administration and PRAC to increasing COVID-EIDL fraud controls: “The PRAC
worked with OMB to conduct a review of SBA’s COVID-EIDL program before the loan threshold was increased to $2
million. That review resulted in the addition of new controls, including additional safeguards to detect against and
handle suspicious IP addresses, additional program eligibility checks, and other preventative measures. See:
Pandemic Response Accountability Committee. Statement of Michael E. Horowitz, Chair, before the U.S. House of
Representatives Select Committee on the Coronavirus Crisis. February 1, 2023.
https://oig.justice.gov/news/testimony/statement-michael-e-horowitz-chair-pandemic-response-accountability-
committee-2#:~:text=The%20PRAC%20worked%20with%20OMB,was%20increased%20to%20%242%20million.
Also see: Statement of Michael E. Horowitz, before the U.S. Senate Committee on Homeland Security and
Government Affairs. March 17, 2022. https://oig.justice.gov/sites/default/files/2022-03/03-17-2022.pdf.
8
The White House. FACT SHEET: President Biden’s Sweeping Pandemic Anti-Fraud Proposal: Going After Systemic
Fraud, Taking on Identity Theft, Helping Victims. March 2, 2023. https://www.whitehouse.gov/briefing-
room/statements-releases/2023/03/02/fact-sheet-president-bidens-sweeping-pandemic-anti-fraud-proposal-
going-after-systemic-fraud-taking-on-identity-theft-helping-victims/.
9
U.S. Congressional Budget Office. Interim Economic Projections for 2020 and 2021. May 19, 2020.
https://www.cbo.gov/publication/56351. Also see U.S. Bureau of Labor Statistics. Employment Situation News
Release. April 3, 2020. https://www.bls.gov/news.release/archives/empsit_04032020.htm.
10
“Mnuchin warns senators of 20% US unemployment without coronavirus rescue, source says.” CNBC.com. March
18, 2020. https://www.cnbc.com/2020/03/18/mnuchin-warns-senators-of-20percent-us-unemployment-without-
coronavirus-rescue-source-says.html.
11
Rainey, Rebecca and Forgey, Quint. “Unemployment claims near 17 million in three weeks as coronavirus
ravages economy.” POLITICO. April 9, 2020. https://www.politico.com/news/2020/04/09/coronavirus-
unemployment-claims-numbers-176794.
29
12
Tankersley, Jim. “As Job Losses Mount, Lawmakers Face a Make-or-break Moment.” The New York Times. May 9,
2020. https://www.nytimes.com/2020/05/09/business/as-job-losses-mount-lawmakers-face-a-make-or-break-
moment.html.
13
U.S. Census Bureau. Business Formation Statistics. https://www.census.gov/econ/bfs/index.html.
14
U.S. Government Accountability Office. COVID-19: Opportunities to Improve Federal Response and Recovery
Efforts. June 25, 2020. https://www.gao.gov/products/gao-20-625. Also see U.S. Small Business Administration
Office of Inspector General. Serious Concerns of Potential Fraud in Economic Injury Disaster Loan Program
Pertaining to the Response to COVID-19. July 28, 2020. https://www.sba.gov/sites/default/files/2020-
07/SBA_OIG_Report_20-16_508.1.pdf.
15
GAO, June 2020. Also see U.S. Small Business Administration Office of Inspector General. “Management Alert
Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List.” January 11, 2021.
https://www.sba.gov/document/report-21-06-management-alert-paycheck-protection-program-loan-recipients-
department-treasurys-do-not-pay-list. Also see: U.S. Small Business Administration Office of Inspector General.
“Duplicate Loans Made Under the Paycheck Protection Program.” March 15, 2021.
https://www.sba.gov/document/report-21-09-duplicate-loans-made-under-paycheck-protection-program.
16
See, for example: U.S. Small Business Administration Office of Inspector General. “SBA’s Paycheck Protection
Program Loan Review Process.” Page 5. https://www.sba.gov/sites/default/files/2022-
02/SBA%20OIG%20Report%2022-09.pdf.
17
U.S. Government Accountability Office. Restaurant Revitalization Fund: Opportunities Exist to Improve Oversight.
Page 33. July 14, 2022. https://www.gao.gov/products/gao-22-105442.
18
SAM (System for Award Management) registration, FAPIIS (Federal Awardee Performance and Integrity
Information System), and LexisNexis are some examples.
19
See GAO Fraud Framework 2015.
20
US Government Accountability Office. COVID-19 Opportunities to Improve Federal Response and Recovery
Efforts, June 2020 (Report 20-265). https://www.gao.gov/assets/gao-20-625.pdf; COVID-19 Urgent Actions
Needed to Better Ensure an Effective Federal Response, November 2020 (Report 21-191).
https://www.gao.gov/products/gao-21-191; COVID-19 Critical Vaccine Distribution, Supply Chain, Program
Integrity, and other Challenges Require Focused Federal Attention January 2021 (Report 21-265)
https://www.gao.gov/assets/gao-21-265.pdf; Sustained Federal Action is Crucial as Pandemic Enters its Second
Year. March 2021 (Report 21-387) https://www.gao.gov/assets/gao-21-387.pdf. GAO report 21-387 has 5
recommendations and reports 20-625, 21-191, 21-265 each have one recommendation related to fraud. The
recommendation in GAO report 20-625 closed April 2022 and recommendations in GAO reports 21-191 and 21-265
closed December 2022. As of April 2023, 3 recommendations from GAO Report 21-387 have closed.
21
Although improper payment classifications are not indicative of fraud in the portfolio, SBA put controls in place
to prevent improper payments as well. As of March 31, 2022, the PPP improper payments rate was estimated as
1.83%, and the COVID-EIDL improper payments rate was estimated as 4.50%.
22
U.S. Small Business Administration Office of Inspector General. Top Management and Performance Challenges
Facing the Small Business Administration in Fiscal Year 2023. Page 6. October 14, 2022. Noted improvements
included: Establishing a Fraud Risk Management Board in 2022; Developing a webpage dedicating to preventing
fraud and identity theft, which includes a section entitled “Lenders and Fraud Response”; Developing aggregate
review processes to identify different fraud scenarios; Developing and implementing a Master Review Plan that
established guidelines for loan and forgiveness reviews; Increasing antifraud controls for loans originating in 2021,
including checking application data against Treasury’s Do Not Pay system; Developing and implementing SBA and
contractor fraud risk management policy and framework; Increasing post-disbursement antifraud controls for
loans that originated in 2020; Commencing manual loan and forgiveness reviews; Engaging a contractor with
expertise in detection and identification of potential fraud; Using a contractor’s automated review tool and the
SBA Paycheck Protection Platform to analyze loans for fraud and eligibility; Implementing machine learning
functionality to focus on areas of higher risk; Providing outreach and training; and Implementing processes to refer
potential fraud to SBA OIG.
30
23
Pandemic Response Accountability Committee (PRAC). Risk Advisory – Potential Identity or Other Fraud in SBA
Pandemic Relief Programs. September 20, 2022. https://www.oversight.gov/report/PRAC/Risk-Advisory-
%E2%80%93-Potential-Identity-or-Other-Fraud-SBA-Pandemic-Relief-
Programs#:~:text=The%20PRAC%20identified%20possible%20identity%20or%20other%20fraud,Development%E2
%80%99s%20Low%20Rent%20and%2For%20Housing%20Choice%20Voucher%20program.
24
PRAC, September 2022. Also see: Pandemic Response Accountability Committee (PRAC). FRAUD ALERT: $5.4
Billion in Potentially Fraudulent Pandemic Loans Obtained Using over 69,000 Questionable Social Security
Numbers. January 30, 2023. https://www.oversight.gov/report/PRAC/FRAUD-ALERT-PRAC-Identifies-54-Billion-
Potentially-Fraudulent-Pandemic-Loans-
Obtained#:~:text=The%20PRAC's%20Pandemic%20Analytics%20Center,19%20Economic%20Injury%20Disaster%20
Loan.
25
U.S. Government Accountability Office. Fraud in the Federal Government – Challenges Determining the Extent of
Federal Fraud. January 23, 2023. https://www.gao.gov/products/gao-23-106110.
26
GAO, January 2023.
27
Deputy IG Shoemaker Testimony
28
SBA COVID Programs (PPP, COVID-EIDL, RRF, & SVOG): $1.2 trillion disbursed, 22.1 million recipients received
funds (all programs), and nearly 5,400 lenders supported PPP. TARP: $431 billion disbursed; 763 financial
institutions received funds. Although both organizations received $50 million in initial administrative funding, SBA
OIG has only received modest amounts of supplemental funds and SIGTARP has received at least $15 million in
additional annual appropriations annually.
29
U.S. Small Business Administration Office of Inspector General. FY 2024 Budget Justification. Page 1.
30
Although this recommendation references IRS data, there is also support for sharing Social Security
Administration data. See PRAC January 2023.
32
PRAC January 2023. Also see GAO January 2023.
33
House Select Subcommittee on the Coronavirus Crisis Staff Report “We are Not the Fraud Police: How FinTechs
Facilitated Fraud in the Paycheck Protection Program” (December 2022).
31
File and source
- File
- SBA-Protecting-the-Integrity-of-Pandemic-Relief-Programs-2023-06.pdf
- Size
- 1,349,786 bytes
- SHA-256
- f3786ed8276d55554477f34c9e9685a3665f602a404639e729628a4be7ced1ca
- Original
- www.sba.gov