SBA OIG 21-02: Initial Disaster Assistance Response to COVID
Archived source: SBA OIG Report 21 02 508 1 Pdf Ca396d7a5b34246b. Captured from www.sba.gov.
Cited in: Brittany Whitesell Biles ("Britt Biles") · Martin "Sparky" Conrey
Full text
S B A I N S P E C T O R G E N E R A L I N S P E C T I O N R E P O R T
INSPECTION OF SMALL BUSINESS
ADMINISTRATION’S INITIAL DISASTER
ASSISTANCE RESPONSE TO THE
CORONAVIRUS PANDEMIC
REPORT NUMBER 21-02 | October 28, 2020
EXECUTIVE SUMMARY Report Number 21-
02
SMALL BUSINESS ADMINISTRATION’S INITIAL DISASTER October 28, 2020
ASSISTANCE RESPONSE TO THE CORONAVIRUS PANDEMIC
What OIG Reviewed combined with lowered controls resulted in
billions of dollars in potentially fraudulent loans
This report presents the results of our inspection and loans to potentially ineligible businesses.
to assess the Small Business Administration’s
(SBA’s) initial disaster assistance response to the Based on our analysis of SBA’s COVID-19 EIDL data,
Coronavirus Disease 2019 (COVID-19) pandemic. as of July 31, 2020, we found SBA approved
SBA’s Disaster Assistance Program is the federal $14.3 billion ($13.4 billion disbursed) in COVID-19
government’s primary program for providing EIDLs to accounts that differed from the original
disaster assistance. SBA provides Economic Injury bank accounts listed on the loan applications;
Disaster Loans (EIDLs) of up to $2 million to $62.7 billion ($58.0 billion disbursed) in multiple
eligible entities such as small businesses, (between 2 and 245) COVID-19 EIDLs to applicants
nonprofits, farms, etc. using the same IP addresses, email addresses, bank
accounts, or businesses listed at the same
The Coronavirus Preparedness and Response addresses; and approximately $1.1 billion in
Supplemental Appropriations Act deemed COVID- COVID-19 EIDLs and emergency advance grants to
19 a disaster. The Act authorized SBA to provide potentially ineligible businesses.
EIDLs to eligible entities under the Small Business
Act in geographic locations declared disaster areas. OIG Recommendations
In addition, the Coronavirus Aid, Relief, and
We made 10 recommendations for SBA to
Economic Security Act provided $10 billion for a
strengthen its controls to lower fraud risk and
new vehicle—emergency advance grants. The
recover funds from ineligible businesses as it
Paycheck Protection Program and Healthcare
continues to respond to the ongoing pandemic.
Enhancement Act provided another $10 billion for
the emergency advance grants and $50 billion in Agency Response
loan credit subsidy to support approximately
$366 billion in additional disaster loans. SBA Management disagreed with the audit findings
we report here. Management only partially agreed
To meet our objective, we reviewed key provisions with recommendations 1 through 8 and 10.
of the laws as well as SBA’s policies and Management disagreed with recommendation 9.
procedures, and information on both SBA’s website
and the loan application. Additionally, we analyzed Overall management stated it disagreed with the
loan data to determine if loans were provided to findings because there was insufficient evidence
ineligible businesses and identify suspicious loan that loans were approved and disbursed to
activity. Finally, we interviewed SBA and ineligible businesses. It is important to note that
subcontractor personnel. despite management disagreeing with the findings
and only partially agreeing with 9 of the
As of July 31, 2020, SBA had received over
recommendations, in most cases, the agency is
14 million COVID-19 EIDL applications, of which it
taking corrective actions to fully implement our
approved 3.2 million for a total of $169.3 billion.
recommendations.
Additionally, SBA had disbursed 5.8 million
emergency advance grants for $20 billion. We have included management’s comments on this
What OIG Found report in Appendix III.
SBA’s initial response to implement the COVID-19
EIDL program made billions of dollars of capital
available to provide prompt economic relief to
businesses affected by COVID-19. To expedite the
process, SBA “lowered the guardrails” or relaxed
internal controls, which significantly increased the
risk of program fraud. The unprecedented demand
for COVID-19 EIDLs and the equally unprecedented
challenges SBA had in responding to this pandemic
Office of Inspector General
U.S. Small Business Administration
Report Number 21-02
DATE: October 28, 2020
TO: Jovita Carranza
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: Small Business Administration’s Initial Disaster Assistance Response to the
Coronavirus Pandemic
This report presents the results of our inspection of the Small Business Administration’s initial
disaster assistance response to the coronavirus pandemic. We considered management’s comments
on the draft of this report when preparing the final report. Management partially agreed with
recommendations 1 through 8 and 10 and disagreed with recommendation 9.
If you have any questions please contact me or Andrea Deadwyler, Assistant Inspector General for
Audits, at (202) 205-6586.
cc: William Manger, Chief of Staff and Associate Administrator, Office of Capital Access
James Rivera, Associate Administrator, Disaster Assistance
Christopher Gray, Deputy Chief of Staff
Brittany Biles, General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management
Martin Conrey, Attorney Advisor, Legislation and Appropriations
Tonia Butler, Director, Office of Internal Controls
Tami Perriello, Chief Financial Officer and Policy Advisor to the Administrator
Table of Contents
Introduction ............................................................................................................................................................................... 1
Figure 1. SBA COVID-19 EIDL Decisions as of July 31, 2020 ........................................................................ 2
Background ........................................................................................................................................................................... 2
Unprecedented COVID-19 EIDL Application Volumes ........................................................................................ 3
Loan Portal ............................................................................................................................................................................ 3
Table 1. Disaster Loan Portal Unscheduled Downtime, March 2020 ....................................................... 3
Table 2. SBA March 2020 COVID-19 EIDL Policy Decisions......................................................................... 4
Volume Leads SBA to Outsource the Receiving and Processing of Applications to an Existing
Contractor .............................................................................................................................................................................. 4
Figure 2. Number of Loan Applications Received by Subcontractor Number 2 as of July 31,
2020..................................................................................................................................................................................... 5
Additional Criteria Changes – Coronavirus Aid, Relief, and Economic Security Act ............................... 6
Table 3. CARES Act Changes to COVID Injury Loan ......................................................................................... 7
Eligibility and Repayment Requirements ............................................................................................................ 7
Requirements Before CARES Act ............................................................................................................................. 7
Requirements After CARES ACT .............................................................................................................................. 7
SBA and Subcontractor’s Processes for Recommending Approval or Decline of COVID-19 EIDLs. 8
Figure 3. Flowchart of the Major Steps in SBA’s and Subcontractor Number 2’s Process. ............. 9
April Policy Changes to Extend COVID Injury Loan Funds ........................................................................... 9
Paycheck Protection Program and Healthcare Enhancement Act ............................................................... 10
Funding Still Available as of July 31, 2020 .............................................................................................................10
Table 4. Status of COVID-19 EIDLs as of July 31, 2020 ................................................................................. 11
Timing of COVID-19 EIDLs and Advance Grants .................................................................................................11
Figure 4. Timing from Loan Application Receipt by Subcontractor to Funding ................................ 12
Figure 5. Grant Payment Timeframes as of July 31, 2020 ........................................................................... 13
Staffing..............................................................................................................................................................................13
Figure 6. Number Employees and Contractors in SBA Office of Disaster Assistance March 1-July
31, 2020 ...........................................................................................................................................................................14
Figure 7. Calls Received by SBA’s Customer Service Center March 1-July 31, 2020........................ 14
Figure 8. Longest Call Wait Times by SBA’s Customer Service Center March 15-July 31, 2020. 15
Objective ...............................................................................................................................................................................15
Results ...................................................................................................................................................................................15
Finding 1: SBA Approved $14.3 Billion in Potentially Fraudulent Loans to Accounts that Differed
from the Original Bank Accounts Listed on Applications ..................................................................................... 17
Recommendations ............................................................................................................................................................18
Finding 2: SBA Approved Billions of Dollars in Potentially Fraudulent Loans to Applicants Using
Duplicate Information (IP Addresses, Email Addresses, Business Addresses, and Bank Accounts) .. 19
Figure 9. Overlap of Potentially Fraudulent Activity in EIDLs and Advance Grants ........................ 20
Multiple Loans to Applicants Using the Same IP Addresses ........................................................................... 20
Table 5. Sample of Top 10 IP Addresses Receiving Most Multiple Loans with Amounts as of July
31, 2020 ...........................................................................................................................................................................20
Multiple Loans to Applicants Using the Same Email Addresses.................................................................... 21
Table 6. Sample of Top 10 Email Addresses Receiving Most Multiple Loans with Amounts as of
July 31, 2020 ..................................................................................................................................................................22
Multiple Loans to the Businesses with the Same Address on the Loan Application............................. 22
Table 7. Sample of Top 10 Addresses Receiving the Most Multiple Loans and Amounts as of July
31, 2020 ...........................................................................................................................................................................23
Multiple Loans to the Same Bank Accounts ...........................................................................................................23
Table 8. Sample of Top 10 Bank Accounts Receiving the Most Multiple Loans as of July 31, 2020
.............................................................................................................................................................................................24
Table 9. Sample of Vague Borrower Names as of July 31, 2020 ............................................................... 27
Recommendations ............................................................................................................................................................28
Finding 3: SBA Approved Approximately $1.1 Billion in Loans and Advance Grants to Potentially
Ineligible Entities ...................................................................................................................................................................29
Recommendations ............................................................................................................................................................30
Analysis of Agency’s Response and Summary of Actions to Close the Report ............................................. 31
OIG Analysis of Agency’s Response ...........................................................................................................................31
Summary of Actions to Close the Report ................................................................................................................33
Appendix 1: Objective, Scope, and Methodology ......................................................................................................38
Appendix 2: Summary of Prior OIG Reports Related to the SBA’s EIDL Disaster Assistance Response
to COVID-19 .............................................................................................................................................................................40
Appendix 3: Management Comments ...........................................................................................................................41
SBA RESPONSE TO INSPECTION REPORT .............................................................................................................41
Introduction
The Small Business Administration’s (SBA’s) Disaster Assistance Program is the federal
government’s primary program for assisting small businesses, small agricultural cooperatives, and
most private, nonprofit organizations after disasters. SBA provides up to $2 million in economic
injury disaster loans (EIDLs) to help these eligible entities meet financial obligations and operating
expenses.
In this report, we present the results of the Office of Inspector General’s (OIG’s) inspection to assess
SBA’s initial disaster assistance response to the Coronavirus Disease 2019 (COVID-19) pandemic.
To provide prompt economic relief to businesses affected by the Coronavirus Disease 2019 (COVID-
19) pandemic, SBA was tasked with lending more than $373 billion in COVID-19 EIDLs and $20
billion in COVID-19 emergency advance grants, which is more disaster loan funding than all the
years combined since the agency was created in 1953.
The March 6, 2020, Coronavirus Preparedness and Response Supplemental Appropriations Act
designated COVID-19 a disaster, which allowed SBA in accordance with the Small Business Act to
provide EIDLs to affected eligible entities in declared disaster areas (See Figure 1). 1 Additional laws
passed in response to the COVID-19 pandemic and discussed in this report expanded the types of
organizations that qualify as eligible entities and created a new emergency advance grant program
(See pages 6 and 10).
Overall, eligible entities for COVID-19 EIDLs are defined as small businesses; small agricultural
cooperatives; most private, nonprofit organizations; businesses, cooperatives, Employee Stock
Ownership Plans, and tribal concerns with no more than 500 employees; sole proprietorships;
independent contractors; and agricultural enterprises. 2
1 Public L. No. 116-123
2 Agricultural enterprises means small business concerns engaged in the production of food and fiber, ranching and
raising of livestock, aquaculture, and all other farming and agricultural-related industries, as defined by section 18(b) of
the Small Business Act (15 U.S.C. 647(b)).
1
Figure 1. SBA COVID-19 EIDL Decisions as of July 31, 2020
Source: OIG analysis of SBA, congressional, and other events
Background
On March 12, 2020, the SBA Administrator issued a press release stating SBA was beginning to offer
EIDLs of up to $2 million. On March 16, 2020, the first states (California, Connecticut, Maine, and
Washington) were declared statewide COVID-19 disaster areas. 3 By March 21, 2020, all states, the
District of Columbia, and U.S. territories had been declared disaster areas. The declarations and
COVID-19 being deemed a disaster allowed SBA to use about $1.1 billion in its disaster loan credit
subsidy account to support $7 billion to $8 billion in EIDLs. 4
SBA’s standard EIDLs are low interest loans (not to exceed 4 percent interest) to meet working
capital requirements during the disaster-affected period until normal operations resume. 5 The loan
term is determined by the borrower’s ability to repay the loan but cannot be more than 30 years.
SBA typically determines repayment ability using the business’s federal tax return and other
income and expense information. The needs of the business and amount of economic injury
determines the actual loan amount up to the legislative maximum amount of $2 million. SBA can set
the maximum amount lower than $2 million.
For COVID-19 EIDLs, SBA lowered the maximum amount to $500,000 on March 16, 2020. That
same day, SBA also set the minimum credit score for application approval.
Applicants can download an application or SBA will mail, email, or fax an application to them. The
applicants can return the completed application by mail, email, or fax. This report refers to all faxed,
emailed, and mailed applications as “mail-in applications.”
3 Federal Register, Vol 85, No. 69, Disaster Declarations of Economic Injury for the Coronavirus (COVID-19);
Administrative Declarations of Economic Injury Disasters for the Entire United States and U.S. Territories, April 9, 2020.
4 The loan credit subsidy is the estimated long-term cost to the federal government of a direct loan or loan guarantee. The
subsidy equals the net present value of estimated cash flows from SBA (for new disaster loans) minus the estimated cash
flows to SBA (payments expected to be received over time on existing disaster loans), excluding administrative costs.
5 Disaster loan interest rates are set by federal statute and are based on the current Treasury funds rate.
2
Unprecedented COVID-19 EIDL Application Volumes
After SBA’s March 12, 2020, announcement, applicants quickly began applying for COVID-19 EIDLs
by the tens of thousands. SBA suddenly had to handle unprecedented numbers of applications. For
example, on March 31, 2020, more than 680,000 applications came in, the highest number of loan
applications SBA has ever received on 1 day. By April 10, 2020, SBA had received more than
4.5 million loan applications, well above the average of 65,000 per year before the pandemic. By
July 31, 2020, SBA had received over 14 million COVID-19 EIDL applications, in which it approved
3.2 million for $169.3 billion. Additionally, SBA disbursed 5.8 million emergency advance grants,
totaling $20 billion.
To put this volume in perspective, an SBA official testified during a congressional hearing that since
SBA was founded in 1953, SBA had approved 2.2 million disaster loans for $66.7 billion. 6 SBA has
now approved and disbursed more loans for COVID-19 relief than for all other disasters combined
in the agency’s history.
To further emphasize the unprecedented volume, SBA approved the following multibillion-dollar
loan volumes:
• Hurricanes Katrina, Rita, and Wilma—SBA approved 160,845 loans totaling $11 billion.
• Superstorm Sandy—SBA approved 38,094 loans totaling $2.6 billion.
• Hurricanes Harvey, Irma, and Maria—SBA approved 145,636 loans totaling $7.4 billion.
• Hurricanes Florence and Michael—SBA approved 25,991 loans totaling $1.16 billion.
Loan Portal
SBA’s Disaster Loan Application Portal did not have the capacity to handle the number of applicants
seeking COVID-19 relief who logged in simultaneously. Consequently, the system was slow and
periodically froze or crashed. The portal did not work at all for 30 or more minutes at least three
times in March 2020, once for more than 6 hours (See Table 1).
Table 1. Disaster Loan Portal Unscheduled Downtime, March 2020
Portal Unscheduled
Date
Down Time (minutes)
March 16, 2020 31
March 24, 2020 152
March 25, 2020 387
Source: SBA
SBA’s Office of Disaster Assistance issued a series of internal memorandums beginning on
March 18, 2020, to attempt to streamline application processing for COVID-19 EIDLs (See Table 2).
6 U.S. House of Representatives, Small Business Committee, The Economic Injury Disaster Loan Program: Status Update
from the Administration,116th Cong., 2d sess., July 1, 2020, https://youtu.be/qdxq-fZWh3c (accessed September 8, 2020).
3
Table 2. SBA March 2020 COVID-19 EIDL Policy Decisions
Eligibility and Repayment Requirements for Requirements for COVID-19
Requirements Standard SBA EIDLs EIDLS
Federal Tax Returns (Businesses
Required Document Not Required
and Agriculture Coops)
Federal Tax Returns (Nonprofits) Required Document Required Document
Open Bankruptcies Not Automatic Disapproval Not Automatic Disapproval
Credit Elsewhere Test Required Test Required Test
Minimum Credit Score Required Requireda
Delinquent Federal Debt Not Automatic Disapproval Not Automatic Disapproval
Required for Required for
Title Search
Loans above $250,000 Loans of more than $500,000
Length of Loan Up to 30 years 30 years
Preferred on loans
Real Estate Collateral Not Required
Greater than $25,000
Furniture, Fixtures, Required for loans Required for loans
and Similar Collateral Greater than $25,000 Greater than $25,000
Personal Guarantee Required for principals. Required for principals.
Hazard Insurance Proof before disbursementb Proof within 12 months
Sources: March 18, 2020, Office of Disaster Assistance (ODA) Memo 20-17 Coronavirus Processing Changes; March 20,
2020, ODA Memo 20-18 Coronavirus Processing Changes Number 2; March 22, 2020, ODA Memo 20-19 Coronavirus
Collateral and Insurance Changes
a Before COVID-19 changes, a credit score above the minimum credit score meant the applicant was eligible from a credit
standpoint but was still required to demonstrate repayment ability. After COVID-19, meeting the minimum credit score
was considered as eligible both from a credit standpoint and repayment ability.
b This is only applicable to standard EIDLs that met the threshold requiring security. Unsecured loans did not require
proof of hazard insurance.
Volume Leads SBA to Outsource the Receiving and Processing of
Applications to an Existing Contractor
To increase the system’s capacity, SBA moved the application portal from its internal servers to the
cloud, a network of servers that function using the Internet instead of local computers. But on
March 25, 2020, system upgrading caused information on more than 7,900 applications to be
potentially exposed to viewing by other applicants currently logged into the system. When the data
exposure was discovered, SBA closed the application portal to COVID-19 EIDL applications. (The
portal, Disaster Loan Application Portal 1.0, reopened for other disaster-related loan applications
on April 3, 2020.) 7
SBA turned to a contractor that had been hired on December 7, 2018, to streamline application
processing through data analysis and loan underwriting. The contractor’s work was delayed by a
bid protest, but the Government Accountability Office denied the protest on March 25, 2019,
7 In this report, we refer to the application portal for non-COVID-19 disaster loans as Disaster Loan Application Portal 1.0
and the separate portal for COVID-19 EIDLs as Disaster Loan Application Portal 2.0
4
allowing the contract to proceed. The contractor had done only limited work on disaster loans
before the COVID-19 pandemic.
Because of the anticipated loan volume for COVID-19 EIDLs, SBA amended the original contract,
increasing it from $100 million to $600 million on April 17, 2020, and again to $850 million on
August 3, 2020. As of August 3, 2020, SBA had paid $485.8 million on this contract.
The new amended contract tasked the company with receiving applications for and underwriting
COVID-19 EIDLs. The contractor delegated a portion of the non-COVID-19 disaster loan work
(predominately loans to repair homes and personal property) to a subcontractor (subcontractor
Number 1). However, subcontractor Number 1’s system was not suited well to process business
loans like COVID-19 EIDLs, so it delegated that loan processing and advance grant tasks to its sister
company, also as a subcontractor (subcontractor Number 2).
Subcontractor Number 1 continued to assist SBA in processing non-COVID disaster loans.
Subcontractor Number 2 took over the reviewing process of COVID-19 EIDL applications,
recommending either approval or denial of each application. SBA personnel reviewed the
subcontractor’s loan recommendations, made the final decisions, and funded the loans.
From March 26 to March 28, 2020, a separate disaster loan application portal, Disaster Loan
Application Portal 2.0, sent all new loan applications to an electronic “drop box,” or file storage
service, where they were saved while the subcontractor set up its system. In total, 6,543 loan
applications were sent to the drop box. SBA rerouted Disaster Loan Application Portal 2.0 so
applications would go directly to subcontractor Number 2, which started receiving the applications
on March 29, 2020, and began processing loans on April 6, 2020.
Based on subcontractor Number 2’s data, the subcontractor processed 33,542 applications on
March 29, 2020. By July 31, 2020, subcontractor Number 2 had processed 14.1 million COVID-19
EIDL applications. Figure 2 shows the number of applications received by the subcontractor by day
between March 29, 2020, and July 31, 2020.
Figure 2. Number of Loan Applications Received by Subcontractor Number 2 as of
July 31, 2020
800000
700000
600000
500000
400000
300000
200000
100000
0
5
Source: OIG analysis of subcontractor data
Note: Disaster Loan Application Portal 2.0 was closed between April 15, 2020, and May 3, 2020, to all eligible entities
because of a funding lapse. SBA reopened the portal between May 4, 2020, and June 14, 2020, to agricultural enterprises
and reopened to all eligible entities on June 15, 2020 (See p. 11). The openings and closings of the portal represent the
low application volume on certain days.
On March 25, 2020, the day the data exposure was discovered, SBA also stopped processing mail-in
applications. Between March 25, 2020, and July 8, 2020, SBA received approximately 40,000 mail-in
applications, or “hard copy” applications. SBA officials said the agency attempted to contact each
applicant and persuade them to reapply through the Disaster Loan Application Portal 2.0, now
redirected to subcontractor Number 2’s site. SBA officials said they do not know if all the mail-in
applicants reapplied electronically.
Additional Criteria Changes – Coronavirus Aid, Relief, and Economic
Security Act
On March 25, 2020, SBA lowered the required credit score for application approval. An SBA official
said the change was due to “policy decisions” but did not give any further explanation.
On March 27, 2020, the President signed the Coronavirus Aid, Relief, and Economic Security Act
(CARES Act), which made significant changes to the COVID-19 EIDL requirements (See Table 3,
changes in red). 8 Most notably, the Act alleviated the requirements for tax returns and the credit
elsewhere test.
Specifically, the Act said SBA could either approve an applicant based solely on credit score and not
require a tax return or use an alternative method to determine repayment ability. These changes
allowed SBA to approve an eligible applicant based on its credit score, as well as applicant self-
certifications of the business’s start date, activity, annual gross revenues and cost of goods sold. 9
8 Public L. No. 116-136, Sec. 1110
9 Public L. No. 116-136, Sec. 1110 (d)(1). All applicants for standard SBA EIDLs not associated with COVID-
19 must demonstrate repayment ability and have acceptable credit scores to qualify.
6
Table 3. CARES Act Changes to COVID Injury Loan
Eligibility and
Requirements Before Requirements After
Repayment
CARES Act CARES ACT
Requirements
Federal Tax Returns (Businesses
Not Required Not Required
and Agriculture Coops)
Federal Tax Returns (Nonprofits) Required Document Not Required
Open Bankruptcy Automatic Disapproval Automatic Disapproval
Credit Elsewhere Test Required Test Not Required
Credit Score Requireda Requireda
Delinquent Federal Debt Not Automatic Disapproval Not Automatic Disapproval
Required for Loans above Required for Loans above
Title Search
$500,000 $500,000
Length of Loan 30 years 30 years
Real Estate Collateral Not Required Not Required
Furniture, Fixtures, Required for Loans Required for Loans
and Similar Collateral greater than$25,000 greater than$25,000
Personal Guarantee Required for principals. Required for principals.
Hazard Insurance Proof within 12 months Proof within 12 months
Source: OIG analysis of the standard EIDL criteria and criteria in the CARES Act
a Before COVID-19 changes, a credit score above the minimum credit score meant the applicant was eligible from a credit
standpoint but was still required to demonstrate repayment ability. After COVID-19, meeting the minimum credit score
was considered as eligible both from a credit standpoint and repayment ability.
The CARES Act also expanded COVID-19 EIDL eligible entities to include businesses, cooperatives,
Employee Owned Stock Ownership Plans, and tribal concerns with not more than 500 employees;
sole proprietorships with or without employees; and independent contractors affected by
COVID-19. 10 The Act set the period for COVID-19 EIDLs to be made between January 31, 2020,
through December 31, 2020. 11 The Act also mandated that only eligible entities in operation before
February 1, 2020, would be eligible for loans. 12
The CARES Act designated $10 billion for COVID-19 emergency advance grants. 13 The Act allows
eligible entities that have applied for a COVID-19 EIDL to request an advance grant of up to $10,000
and request SBA to pay out the funds within 3 days of receiving an application. 14 The applicant is
10 Public L. No. 116-136, Sec. 1110(a)(2)-(b)
11 Public L. No. 116-136, Sec. 1110(a)(1)
12 Public L. No. 116-136, Sec. 1110(c)(2)
13 Public L. No. 116-136, Sec. 1110(e)(7). The CARES Act refers to the funds as COVID-19 emergency grants. In this report,
we refer to the funds as advance grants in keeping with our recent Management Alert about fraud in the COVID-19 EIDL
program, summarized here under “Prior Work.”
14 Public L. No. 116-136, Sec. 1110(e)(3) & Public L. No. 116-136, Sec. 1110(e)(1)
7
not required to repay any of the advance grant, even if later denied a COVID-19 EIDL. 15 SBA decided
to limit advances to $1,000 per employee for up to 10 employees. 16
SBA and Subcontractor’s Processes for Recommending Approval or
Decline of COVID-19 EIDLs
It is important to note that subcontractor Number 2’s system electronically checks the application;
each application is not reviewed by the subcontractor’s personnel. Subcontractor Number 2’s
system uses public domain information and certain fraud indicators in accessing and verifying loan
application information.
The subcontractor’s system verification check of the bank accounts is contingent on each bank’s
Customer Identification Program and the amount of customer information collected as required
under 31 C.F.R. § 1020.220. The subcontractor estimates that 40 percent of banks do not collect
enough information for its system to verify a bank account.
We were told the system makes these checks before the credit check to determine loan eligibility
based on application information. The main reasons the system would deem an application
ineligible are insufficient economic injury, ineligible business type, or ineligible answers to other
application questions, such as felony convictions, etc.
Figure 3 shows SBA’s and subcontractor Number 2’s process for approving or declining COVID-19
EIDL applications for both the loans and advance grants.
15 Public L. No. 116-136, Sec. 1110(e)(5)
16 SBA Internal Memorandum, Authorization for Payments from [Contractor], April 7, 2020. The total disbursement
amount for each record included in the payment file is calculated based on the following logic: 1) if number of employees
is 0 then $1,000, 2) if number of employees is greater than 10 then amount is $10,000, or 3) otherwise amount is number
of employees times $1,000.
8
Figure 3. Flowchart of the Major Steps in SBA’s and Subcontractor Number 2’s
Process.
Source: SBA subcontractor Number 2
After subcontractor Number 2’s system determines eligibility of the loan application, it sends the
loan application to SBA with a recommendation to approve or decline and flags the record with any
concerns. Between late March 2020 and early April 2020, SBA set policies for the SBA loan officers
and team leads to follow for processing COVID-19 EIDL applications.
In addition to the 40,000 mail-in applicants that SBA contacted to reapply, the agency set up
automatic “robocalls” to contact more than 90,000 applicants whose unprocessed applications had
been received by SBA before closing Disaster Loan Application Portal 1.0 to COVID-19 applications.
SBA also contacted the 6,543 applicants whose unprocessed applications were received in the drop
box site during the portal outage. Both were encouraged to reapply using the Disaster Loan
Application Portal 2.0. If those applicants did not reapply, they did not receive an advance grant.
SBA required reapplication to ensure the applications went directly to subcontractor Number 2’s
processing system. SBA’s message told the applicant that the new application would be used for
both the COVID-19 EIDL and the advance grant. SBA also mailed notices to the applicants to notify
them of the requirement to reapply. Unlike the mail-in applications (hard copy applications), SBA
officials said they maintained these applicants’ places in line according to the receipt date of their
previous unprocessed digital application.
April Policy Changes to Extend COVID Injury Loan Funds
In March 2020, SBA had between $7 billion and $8 billion available for COVID-19 EIDLs and non-
COVID disaster loans. It set the COVID-19 EIDL maximum at $500,000. But the huge number of loan
applications quickly depleted the funds. Consequently, the agency lowered the maximum COVID-19
9
EIDL amount to $15,000 on April 3, 2020, stating this change was made to help as many businesses
as possible.
However, a week later on April 11, 2020, SBA restored the maximum amount of a COVID-19 EIDL to
$500,000 and the minimum required credit score back to the original. According to an SBA official,
the changes were “policy decisions.” The official did not give any additional explanation.
On April 15, 2020, SBA closed the Disaster Loan Application Portal 2.0 to new applications. The
agency had received approximately 5.5 million applications, but officials did not know how much
funding would be appropriated in Congress’s next relief act. The next day, April 16, 2020, SBA
determined it had obligated all disaster funds up to that point.
Paycheck Protection Program and Healthcare Enhancement Act
The President signed the Paycheck Protection Program and Healthcare Enhancement Act on
April 24, 2020. 17 This Act appropriated an additional $10 billion for advance grants and an
additional $50 billion to SBA’s disaster loan credit subsidy account to support approximately $366
billion in additional loans. 18
On May 3, 2020, SBA made the decision to cut the COVID-19 EIDL maximum from $500,000 to
$150,000. The Act also expanded eligible entities to include agricultural enterprises. 19 The next day,
May 4, 2020, SBA reopened its Disaster Loan Application Portal 2.0 only for agricultural business
applications.
Funding Still Available as of July 31, 2020
As of June 11, 2020, SBA reported it had disbursed approximately $10.7 billion in advance grants.
SBA had approximately $9.3 billion in advance grant funding remaining available. By July 14, 2020,
SBA had awarded the entire $20 billion in advance grants. SBA also reported in mid-June that it had
approved approximately $91 billion of $373 billion in COVID-19 EIDLs. On June 15, 2020, SBA
reopened its Disaster Loan Application Portal 2.0 to all eligible entities.
On July 10, 2020, SBA officials said the agency had approximately 280,000 approved loans yet to be
disbursed. SBA officials said some of the undisbursed loans were awaiting borrower action, such as
signing loan documents. In some other cases, there were errors in the borrower’s application, such
as incorrect bank routing numbers for direct deposit delaying disbursement. SBA decided that
these loans will be deobligated after 90 days of borrower inaction or the agency is unable to contact
the borrower.
We analyzed the number of COVID-19 EIDLs recorded in SBA’s Capital Access Financial System. As
of July 31, 2020, there were more than 345,000 approved loans totaling approximately $13.8 billion
to be disbursed (See Table 4). The agency still had approximately $204 billion of $373 billion
($373 billion minus the $169 billion disbursed or obligated) to lend for disaster loans as of July 30,
2020.
17 Public L. No. 116-139
18 Public L. No. 116-139, Div. A Sec. 101(b) and Title II “Disaster Loans Programs Account”
19 Public L. No. 116-139, Div. A Sec. 101(c)
10
Table 4. Status of COVID-19 EIDLs as of July 31, 2020
Loan Statusa Number Dollar Amount ($)
Disbursed Current 2,778,328 $155,406,147,663
Active Undisbursed 345,465 13,750,708,775
Paid in Full 5,473 164,585,700
In Liquidation Disbursed 51 6,810,000
Fully Cancelled 38,909 0
Total 3,168,226b $169,328,252,138
Source: OIG analysis of SBA’s Capital Access Finance System
a Disbursed Current means the loan has been disbursed to the borrower. Active Undisbursed means the loan has been
approved and obligated but has yet to be disbursed to the borrower. Paid in Full means the loan was disbursed to the
borrower but the borrower or their bank returned the funds. In Liquidation Disbursed means the loan was disbursed to
the borrower and then the borrower went into bankruptcy or died. Fully Cancelled generally means the loan was
approved but the applicant decided not to accept the loan, or the applicant did not accept the loan in time. Applicants
must accept loans within 90 days of approval.
b This includes 298 loans in the Capital Access Financial System (117 Cancelled and 181 Active Undisbursed) that we
could not tie back to an application in subcontractor Number 2’s system, the SBA’s application system, or the SBA’s data
warehouse. We should have been able to find the 298 loan applications because the data is exported from the
subcontractor’s system to the Capital Access Financial System.
Timing of COVID-19 EIDLs and Advance Grants
SBA took an average of 49 days to receive, underwrite, and fund loan applications for 2,783,755
COVID-19 EIDLs disbursed as of July 31, 2020. In some cases, the process took up to 124 days to
fund loan applications, but some were funded on the same day the application was received (see
Figure 4). 20 Figure 4 shows the number of loans approved and disbursed by number of days after
the application was received. For example, 134,492 loans were funded 68 days after the application
was received (as shown by the red bar in Figure 4).
20 The 345,465 active undisbursed loans shown in Table 4 are not reflected in average loan processing calculation or the
data used for Figure 4. Once these loans are disbursed, the average number of days to process loans could increase.
11
Figure 4. Timing from Loan Application Receipt by Subcontractor to Funding
160,000
140,000
120,000
Nu mber of Loans
100,000
80,000
60,000
40,000
20,000
0 0
4
8
12
16
20
24
28
32
36
40
44
48
52
56
60
64
68
72
76
80
84
88
92
96
100
104
108
112
116
120
124
Number of Days
Source: OIG analysis of subcontractor data
Although the data shows 58,459 EIDLs were funded on the same day as the application was
received, we are concerned about the accuracy of this data, because before funding, SBA personnel
must review the application, and obtain signed documents from the borrowers.
We also compared the date loan applications were recorded in subcontractor Number 2’s system to
the date of grant disbursement. From the beginning of the program through July 31, 2020, SBA took
between 0 days (same day) and 106 days (average of 22 days) to pay out advance grant funds (See
Figure 5). We found SBA paid 1,325,695 grants within 3 days.
Figure 5 shows the number of advance grants approved by number of days after the application
was received. For example, 446,700 advance grants were funded 24 days after the application was
received (as shown by the red bar in Figure 5).
12
Figure 5. Grant Payment Timeframes as of July 31, 2020
500,001
400,001
Number of Loans
300,001
200,001
100,001
1
0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 64 68 72 76 80 84 88 92 96 100104
Number of Days
Source: OIG analysis of subcontractor’s data
Staffing
On February 28, 2020, SBA’s Office of Disaster Assistance had 3,483 employees and contractors. In
March 2020, the office began the process to increase its staff size to 10,000 employees and
contractors for SBA’s initial response to the pandemic and to continue to respond to other disasters
(See Figure 6). By July 31, 2020, the office had more than 9,000 employees and contractors. In
comparison, the highest ever staffing levels previously in SBA’s Office of Disaster Assistance was
just over 5,000 employees working on SBA’s disaster response to Hurricanes Harvey, Irma, and
Maria in 2017.
13
Figure 6. Number Employees and Contractors in SBA Office of Disaster Assistance
March 1-July 31, 2020
10,000
9,111
9,000
8,072
8,000
Number of Employees and
6,833
7,000
6,000
5,000
Contractors
3,478 3,737
4,000
3,000
2,000
1,000
0
3/27/2020 4/24/2020 5/29/2020 6/26/2020 7/31/2020
Source: SBA
From March 1, 2020, to July 31, 2020, SBA’s Customer Service Center received 10.9 million calls
(See Figure 7). Between July 31, 2020, and August 10, 2020, SBA’s Customer Service Center
received almost 700,000 additional calls. SBA data shows 18 percent of callers gave up while
waiting on hold.
Figure 7. Calls Received by SBA’s Customer Service Center March 1-July 31, 2020.
4,000,000
3,500,000
3,000,000
Number of Calls
2,500,000 2,836,582
2,000,000
1,899,551
1,500,000
1,396,011
1,000,000 1,154,095
438,224
0 442,363
500,000
412,089 532,932 352,789 642,803
406,646
0 121,969 132,918 127,755
March April May June July
Other Calls COVID-19 Non-EIDL Calls COVID-19 EIDL Calls
Source: SBA
The overall average call wait time was 14 minutes. But the daily maximum time callers were on
hold between March 15, 2020, and July 31, 2020, ranged from 34 seconds to 4 hours and 10
14
minutes (See Figure 8). 21 SBA also received 2.1 million emails about all COVID-19 loans and more
than 300,000 of these emails had not been answered as of July 31, 2020.
Figure 8. Longest Call Wait Times by SBA’s Customer Service Center March 15-July
31, 2020.
4:48:00
4:19:12
3:50:24
Total Time Calls Were On Hold
3:21:36
2:52:48
2:24:00
1:55:12
1:26:24
0:57:36
0:28:48
0:00:00
2/19/2020 3/10/2020 3/30/2020 4/19/2020 5/9/2020 5/29/2020 6/18/2020 7/8/2020 7/28/2020 8/17/2020
Source: SBA
Objective
Our objective was to assess SBA’s initial disaster assistance response to the COVID-19 pandemic,
including staffing adequacy, loan application volume, timeliness of disaster loan approval, and
customer service.
Results
SBA’s initial response to implement the EIDL program made billions of dollars of capital available to
provide prompt economic relief to eligible entities affected by the COVID-19 pandemic. However,
the unprecedented demand for COVID-19 EIDLs and equally unprecedented challenges SBA had in
responding resulted in billions of dollars being distributed to potentially ineligible entities or
fraudsters because of errors, weaknesses in controls, and fraud. We found several strong fraud
indicators in alignment with what we have uncovered in ongoing criminal investigations
demonstrating that SBA approved:
• approximately $14.3 billion (disbursed $13.4 billion) in potentially fraudulent loans to accounts
that differed from the original bank accounts listed on applications;
21 System issues limited the calculation of wait time for two of the days.
15
• approximately $62.7 billion (disbursed 58.0 billion) in potentially fraudulent loans to applicants
using the same IP address, the same email address, the same bank accounts, or businesses listed
at the same addresses; and
• approximately $1.1 billion in disaster loan funds to potentially ineligible businesses that
registered an Employer Identification Number after the cutoff date of January 31, 2020, which
could indicate they were not in business by this deadline, as required.
16
Finding 1: SBA Approved $14.3 Billion in Potentially Fraudulent
Loans to Accounts that Differed from the Original Bank
Accounts Listed on Applications
We found that as of July 31, 2020, SBA had approved 281,414 COVID-19 EIDLs totaling $14.3 billion
($13.4 billion of which has been disbursed) to applicants who later changed the bank account
number to pay out the loan to a different number than that listed on the original loan application.
For these applications, an additional $13.6 million was disbursed in advance grants. 22
We compared all bank account numbers on loan applications in subcontractor Number 2’s database
to all the bank account numbers for loans in SBA’s Capital Access Financial System. We found
281,414 differences between the bank account number on the application and the number
recorded in Capital Access Financial System.
In some cases, the applicant made mistakes when completing the application. For example, an
applicant put the bank’s routing number in the bank account information field or vice versa.
Another example is transposed numbers in the bank account or routing number or not including all
the digits for those numbers. In such cases, SBA staff generally contacted the applicant if they could
not verify the account number, and the applicant provided the correct information.
However, other scenarios we found are highly suspicious and strong indicators of potential fraud.
Suspicious examples include bank account numbers being significantly different or routing
numbers of entirely different banks than the account numbers on the original application. It is also
suspicious when the change is to an online-only debit card financial institution instead of a checking
account at the brick-and-mortar banking institution listed on the original application.
For example, SBA received 22 loan applications from the same Internet Protocol, or IP address, the
identifying number associated with a specific computer or computer network. The applications
claimed to represent 22 individual farms located in 6 states. Although 13 of the 22 applications
were originally submitted with unique bank accounts, they were submitted from the same IP
address with nearly identical financial data and approved by SBA. Before the loans were disbursed,
the bank account numbers were changed to three separate banks with new routing numbers and
account numbers, none of which were associated with the bank listed on the application. SBA
disbursed $1.9 million dollars to those accounts.
In another specific example, three loan applications were submitted with three unique bank
accounts. After approval but before disbursement, all three applications bank accounts were
changed to a debit card financial institution. Two of the loans were disbursed for $30,300 and the
third loan was approved for $9,300 but had not been disbursed as of July 31, 2020.
An official at SBA’s Subcontractor Number 2 said loan applicants can change the bank account
information at any point in the process. We found this concerning. Essentially, an applicant can use
anyone’s legitimate bank account number to get their application through the controls in the
subcontractor’s system, which includes a verification of the bank account information. Then having
22 For the approved loan amount, we used the Net Gross Amount from SBA’s loan data, which is the original approved
loan amount minus any reduction in the approved amount or cancellation of the approved loans.
17
bypassed the controls, the applicant can later change the account number post-system controls and
before the loan is funded, which greatly increases the risk of undetected fraud.
On August 10, 2020, shortly after we briefed the Administrator on this alarming issue, SBA worked
with the subcontractor to fix the problem. An official at the subcontractor company said in
mid-August 2020, the system controls were changed to require the bank account information to be
revalidated whenever the loan applicant changes the bank account information.
Loans to potentially ineligible borrowers reduce the amount of available critical capital needed for
eligible businesses to withstand the effects of the pandemic and increase the risk of financial loss.
These loans also constitute improper payments under the Payment Integrity Information Act of
2019. 23 The Improper Payments Act defines improper payments to include payments made to
ineligible recipients. 24 SBA should flag these loans for its FY 2021 Improper Payments estimation
process.
Recommendations
We recommend the Administrator to direct the Associate Administrator for Disaster Assistance to:
1. Review all loans that had a bank account number changed from that shown on the original
application to determine if the changes were legitimate or fraudulent. If not legitimate,
work to recover the funds, deobligate any undisbursed funds, and refer to the OIG.
2. Establish or strengthen controls to ensure loan deposits are made to legitimate bank
accounts for eligible borrowers only.
23 Public L. No. 116-117, codified at 31 U.S.C. §§3351 - 3358
24 31 U.S.C. §3351(4)
18
Finding 2: SBA Approved Billions of Dollars in Potentially
Fraudulent Loans to Applicants Using Duplicate Information (IP
Addresses, Email Addresses, Business Addresses, and Bank
Accounts)
We found that as of July 31, 2020, SBA had approved more than one loan to applicants that used the
same IP addresses, email addresses, business addresses, or bank accounts. Although there may be
some legitimate reasons for individual occurrences, multiple occurrences indicate a strong
probability of fraud. Specifically, SBA:
• approved 977,086 potentially fraudulent COVID-19 EIDLs totaling $62.7 billion, of which
$58 billion had been disbursed, to applicants using the same IP addresses (an additional
$614.8 million was disbursed in advance grants);
• approved 319,936 potentially fraudulent COVID-19 EIDLs for $26.7 billion, of which
$25.4 billion has been disbursed, to applicants using the same email addresses (an
additional $172.2 million was disbursed in advance grants);
• approved 260,109 potentially fraudulent COVID-19 EIDLs totaling $15.4 billion, of which
$14.5 billion had been disbursed, to businesses listed at the same address (street, city, and
the zone improvement plan, or ZIP code) on their applications (an additional $134.9 million
was disbursed in advance grants); and
• approved 16,015 potentially fraudulent COVID-19 EIDLs for $928.1 million, of which
$811.5 million had been disbursed, to the same bank accounts (an additional $2.5 million
was disbursed in advance grants). 25
It is important to note that there is overlap among these four subgroups of all the approved COVID-
19 EIDLs as of July 31, 2020 (See Figure 9). The overlap amongst the subgroups indicates a higher
likelihood of fraud.
We recognize that some of the loans in these subgroups could be legitimate and for eligible
businesses. An example would be an accounting or law firm filling out multiple applications for
their clients. However, SBA’s control should have been to thoroughly research these applications
containing duplicative information before approval. Additionally, when the information indicated
suspicious activity, SBA should have requested additional supporting documentation from the
applicants to sufficiently alleviate any fraud concerns. SBA should thoroughly research these
suspicious situations in current loans to determine whether the loans are legitimate, and the
businesses are eligible for COVID-19 EIDLs.
The following subsections describe what we found in each subgroup. We compiled a “top 10” list for
each to show that many IP addresses, email addresses, physical addresses, and bank accounts were
approved for more than 2 loans (and up to 245 loans). We also provide specific examples of
suspicious loan activity, which is in line with the fraudulent loan activity schemes we have
uncovered in our ongoing investigations.
25 For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved
loan amount minus any reduction in the approved amount or cancellation of approved loans.
19
Figure 9. Overlap of Potentially Fraudulent Activity in EIDLs and Advance Grants
$62.7 Billion in Loans and
$614.8 Million in Grants to
Applicants at the Same IP
Addresses
$26.7 Billion
$15.4 Billion
in Loans and
in Loans and
$172.2 Million
$134.9 Million
in Grants to
in Grants to
Applicants at
Businesses at
the Same
the Same
Email
Addresses
Addresses
$928.1 million in Loans and
$2.5 Million in Grants to
the Same Bank Accounts
Source: OIG Analysis of SBA’s COVID-19 EIDLs in SBA’s Capital Access Financial System
Multiple Loans to Applicants Using the Same IP Addresses
Our analysis of the top 10 IP addresses used by applicants to submit and obtain approval for
multiple loans showed that 245 loans were approved for $14.4 million for IP address Number 1
(See Table 5).
Table 5. Sample of Top 10 IP Addresses Receiving Most Multiple Loans with Amounts
as of July 31, 2020
COUNT
BORROWER IP OF APPROVED DISBURSED
ADDRESS LOANS AMOUNT($)a AMOUNT($)
IP Address Number 1 245 $14,458,800 $14,211,500
IP Address Number 2 174 26,693,800 26,329,600
IP Address Number 3 173 14,481,400 14,342,200
IP Address Number 4 168 16,263,700 15,469,000
IP Address Number 5 152 12,868,600 12,511,300
IP Address Number 6 137 11,046,400 10,754,500
IP Address Number 7 133 12,967,600 12,803,000
IP Address Number 8 124 11,821,000 11,012,700
IP Address Number 9 121 9,030,200 8,430,100
IP Address Number 10 114 3,966,300 3,816,300
Source: OIG Analysis of subcontractor’s data
a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved
loan amount minus any reduction in the approved amount or cancellation of approved loans.
We analyzed loan and application data from the subcontractor’s system. Overall, we found
280,520 IP addresses used by applicants to submit multiple applications. SBA approved more than
one loan to each of those applicants.
20
For example, applicant(s) at one IP address and using primarily what looks like an email address at
a fish market with six locations in one state applied for 85 COVID-19 EIDLs loans (SBA approved
84) in various company names of jewelry stores, psychiatric services, construction, gas stations,
and other non-seafood businesses. SBA disbursed $9,383,600 to these potentially fraudulent
companies.
The three following examples raise similar red flags. Note, the applications could have been made
by more than one individual. The key is that all were submitted from the same IP address.
• An applicant at one IP address applied for and SBA approved 10 COVID-19 EIDLs for
different farms. However, some of the addresses for the farms were residential homes or
apartments. This applicant also used an email address with periods that could be moved
within the same address to create several different addresses; for example, john.smith@
and jo.hn.smith@. This technique is another indicator that these are potentially fraudulent
loan applications. SBA disbursed $506,700 for these potentially fraudulent farms.
• An applicant at one IP address submitted 25 applications claiming to represent 21 unique
farms and businesses located across 6 states. Between August 1, 2020, and September 14,
2020, another 3 applications were submitted from this IP address. In total, SBA approved
15 of the applications and disbursed 14 of them for $1,715,100. In between application
submission and disbursement, the applicant changed several of the bank accounts.
Additionally, these applicants used similar email addresses.
• An applicant at one IP address submitted 62 applications claiming to represent 62 unique
farms and businesses located across 22 states. Between August 1, 2020, and September 14,
2020, another 68 applications were submitted from this IP address. In total, SBA approved
13 of the applications and disbursed 8 of them for $349,500. In between application
submission and disbursement, the applicant changed several of the bank accounts. This
applicant also moved the period around in the different email addresses used in the
applications.
Multiple Loans to Applicants Using the Same Email Addresses
Our analysis of the top 10 email addresses used by applicants to apply for and obtain approval of
multiple loans, showed one example of 158 loans approved for $9.4 million using the same email
address. (See Table 6)
21
Table 6. Sample of Top 10 Email Addresses Receiving Most Multiple Loans with
Amounts as of July 31, 2020
COUNT
BORROWER EMAIL OF APPROVED DISBURSED
ADDRESS LOANS AMOUNT($)a AMOUNT($)
Email Address Number 1 158 $9,434,600 $8,696,900
Email Address Number 2 156 14,352,600 13,323,300
Email Address Number 3 120 9,623,100 9,332,600
Email Address Number 4 104 7,582,100 7,548,400
Email Address Number 5 102 9,161,600 8,987,200
Email Address Number 6 94 8,696,700 8,479,200
Email Address Number 7 90 9,060,900 8,481,600
Email Address Number 8 86 4,344,600 2,642,100
Email Address Number 9 83 5,374,700 5,315,900
Email Address Number 10 83 4,225,500 4,113,500
Source: OIG Analysis of subcontractor’s data
aFor the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved loan
amount minus any reduction in the approved amount or cancellation of approved loans.
We analyzed loan data for multiple COVID-19 EIDLs to the same email addresses in SBA’s Capital
Access Financial System. Overall, we found 113,324 email addresses that SBA had approved more
than one loan to applicants that used those email addresses on their applications.
Some of this loan data indicates suspicious activity. For example, applicant(s) at one email address
applied for 10 COVID-19 EIDLs and SBA approved eight loans in various company names (names of
family members, restaurant, hostel, roofing company, karate organization, and other businesses).
SBA disbursed $807,100 to these potentially fraudulent companies.
In another example, an applicant(s) at one email address applied for 10 COVID-19 EIDLs and SBA
approved 10 loans for 10 different bathroom renovation businesses in the same city. However, we
were not able to locate any bathroom renovation companies in that company’s name in that city.
Additionally, the email address indicates it is for a burrito restaurant, which we did locate in that
city. SBA disbursed $1.4 million for these potentially fraudulent companies.
Multiple Loans to the Businesses with the Same Address on the Loan
Application
Our analysis of the top 10 addresses used by applicants to submit and obtain approval for multiple
loans showed that the top address was used for 97 loans. The total loan disbursement was
approximately $1.4 million (See Table 7). We also found that for some of the applications the
business names were the same and for some the business names differed.
22
Table 7. Sample of Top 10 Addresses Receiving the Most Multiple Loans and Amounts
as of July 31, 2020
Number of Approved Disbursed
Borrower Address Loans Amount ($)a Amount ($)
Address Number 1 97 $1,497,200 $1,377,800
Address Number 2 75 1,377,400 1,272,900
Address Number 3 57 2,472,000 2,472,000
Address Number 4 51 1,184,600 1,184,600
Address Number 5 48 2,002,600 1,713,900
Address Number 6 47 1,631,100 1,608,100
Address Number 7 44 569,900 569,900
Address Number 8 41 1,400,000 1,400,000
Address Number 9 40 973,100 973,100
Address Number 10 37 2,442,500 2,293,500
Source: SBA Capital Access Financial System
a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved
loan amount minus any reduction in the approved amount or cancellation of approved loans.
We analyzed loan data for multiple COVID-19 EIDLs to the same address in SBA’s Capital Access
Financial System. Overall, we found 110,549 business addresses (street, city, and ZIP code) for
which SBA approved more than 1 loan for businesses at those locations.
Using basic Internet searches, we determined some of the addresses listed are locations of
registered agent services or locations such as large office buildings that could potentially house
multiple businesses. However, our searches revealed that some of the multiple loans were made to
residential addresses, pharmacies, and a vacant lot.
It seems fraudsters understood that sending a shower of applications increased the likelihood that
one or more would make it through existing controls. For example, one applicant filled out
38 applications, and subcontractor Number 2’s system flagged these loan applications as potential
fraud or duplicates. But some of the applications were reviewed by different loan officers, and at
least two of the loans were approved and disbursed for a total of $384,600.
In another example, 10 COVID-19 EIDL applications were submitted and approved using the same
house address and received $1,136,200. Also, 11 COVID-19 EIDL applications were submitted and
approved using the same apartment address and received $658,300.
Multiple Loans to the Same Bank Accounts
We analyzed loan data from SBA’s Capital Access Financial System for multiple loans to the same
bank accounts. In total, we found 7,282 applicants received more than one loan in their bank
account. (See Table 8 for a sample of the top 10 bank accounts used by applicants to submit and
obtain approval for multiple loans). We also found half of the applicants for these 7,282 loans
applied for multiple loans using the same IP addresses.
23
Table 8. Sample of Top 10 Bank Accounts Receiving the Most Multiple Loans as of
July 31, 2020
Number of Approved Disbursed
Bank Account Loans Amount ($)a Amount($)
Bank Account Number 1 38 $4,977,600 $4,977,600
Bank Account Number 2 28 1,898,900 1,898,900
Bank Account Number 3 22 532,100 532,100
Bank Account Number 4 20 180,400 180,400
Bank Account Number 5 19 268,700 268,700
Bank Account Number 6 17 861,300 861,300
Bank Account Number 7 17 1,003,300 1,003,300
Bank Account Number 8 15 1,755,600 1,755,600
Bank Account Number 9 15 1,115,100 1,115,100
Bank Account Number 10 14 722,100 169,400
Source: SBA’s Capital Access Financial System
a For the approved loan amounts, we used the Net Gross Amount from SBA’s loan data, which is the original approved
loan amount minus any reduction in the approved amount or cancellation of approved loans.
For example, 13 different types of businesses (financial, automotive, gymnastics, etc.) received
loans for $1,167,800 to the same bank account. It is possible these are legitimate different types of
business run out of one bank account. However, it is suspicious behavior and should be researched
by SBA to determine if these are legitimate businesses.
SBA Policy Changes. To get funds to eligible entities quickly, SBA “lowered the guardrails” by
removing or weakening of controls. For example, SBA reduced existing controls by abandoning the
rule of two reviewers for each loan application, setting high production goals, approving loans in
batches without review, and ignoring system flags. We have found through thousands of contacts
from banks and hotline complaints and our own data analytics that these actions increased fraud
risk significantly.
Several factors attributed to the potential fraudulent duplicate loans, as follows:
SBA Abandoned the Rule of Two. In a more typical situation, SBA would require the “Rule
of Two,” meaning at least two SBA personnel would have to approve a loan. However, SBA
did not do this for COVID-19 EIDLs. SBA officials told us that the subcontractor sent clean
loan applications recommended for approval in batches of 25 to 50 loans. An SBA team lead
would approve these batches with little to no vetting of the loan information.
Applications are considered clean if the subcontractor’s system does not find any major
problems, such as large number of applications with other lenders, owner information
failed validation, digital identity fraud suspicion, invalid bank account number, or bank
account number does not match business. However, these loans considered by the
subcontractor’s system as clean and included in batches could have multiple minor issues,
such as client location is international, phone number is not associated with the business,
large number of applications in succession, email does not pass validation, or unable to
confirm business registration.
24
An SBA official told us they considered the subcontractor’s system as the first review and
the SBA team lead as the second review. This approach, however, does not satisfy the Rule
of Two because some of the system identified loan application issues were ignored (such as
large number of applications in succession), and some system controls were only
sometimes effective (such as the bank account could only be verified 60 percent of the
time). SBA employees could potentially see trends in fraudulent applications that a system
potentially could not identify, especially if a system is not programmed to detect a change
such as bank account changes or if the system’s capability is limited, such as not flagging all
duplicative loans as discussed below.
Timing Goals for Loan Decisions. Office of Disaster Assistance officials established
production goals that loan officers should make final loan decisions (approval or denial) on
at least 4 loan applications per hour, and team leads should make final loan decisions
(approval or denial) on 10 to 12 loan applications per hour. To meet that goal, the officers
had to make their decisions within an average of 15 minutes and team leads within an
average of 5 to 6 minutes per application despite the complexity and serious nature of the
responsibility entrusted to the loan officers and team leads. SBA’s production requirement
resulted in cursory reviews rather than the deeper reviews required to ensure loans were
given to eligible businesses.
After our briefing on August 10, 2020, SBA issued a new policy that day curtailing approval
of loan applications in batches. 26 This change should help reduce the number of potential
fraudulent loans previously being approved in batches without being properly vetted by
SBA personnel.
SBA Ignored Subcontractor’s System Flags. We found the subcontractor’s system
identified multiple potentially fraudulent applications with duplicate names, account
numbers, addresses, or other information. However, SBA personnel did not always
adequately address the flags before approving the loans. SBA officials took corrective action
after we warned them of the issue. Along with the other policy changes on August 10, 2020,
SBA issued a new informal policy requiring all subcontractor flags on loan applications must
be researched and fully resolved before approving or denying a loan or the application will
be returned to the loan officer. 27 Team leads are required to add notes to the files telling
loan officers what actions to take and what to tell applicants. Loan officers also are required
to document the actions taken to resolve the flags. 28
SBA also set a new procedure requiring loan officers to manually check the applicant’s
Social Security Number and federal Taxpayer Identification Number before processing each
duplicate loan application. These changes should help reduce approvals of potential
fraudulent loans that have duplicate information because they should be properly vetted by
SBA personnel.
26 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2,
August 10, 2020
27 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2,
August 10, 2020
28 SBA Email to Disaster Assistance Processing and Disbursement personnel, [Subcontractor] Procedure Update Number 2,
August 10, 2020
25
Subcontractor’s System Control Did Not Always Flag Duplicative Loans. On August 12,
2020, SBA discovered controls in the subcontractor’s system were not always consistently
flagging problematic loan applications. 29 The system did not link related loan applications
when multiple loan applications had the same information. These features help to prevent
fraud and are also essential in preventing multiple loan decisions to the same entity. This
inoperable control could have led to some loan applications being mistakenly marked
“clean” and erroneously approved in batches. A subcontractor official told us the duplicate-
logic system control was corrected in mid-August.
SBA Action to Address our July 2020 Management Alert on Duplicate Loans. In our July
2020 Management Alert, we warned SBA that we had found approximately $45.6 million in
duplicate loans to the same businesses at the same addresses. 30 The findings in this report are a
continuation of that analysis as we further identified the scope of the potential fraud.
In response to our Management Alert, SBA issued a notice to financial institutions to alert them
to the potential for suspicious activity related to COVID-19 EIDL funds deposited into business
or personal bank accounts. 31 The notice included some examples of suspicious activity, such as
use of stolen identities, EINs, or Social Security Numbers to qualify for the COVID-19 EIDLs and
advance grants. The notice also explained how to report suspicious banking activity to SBA.
As we continued our analysis post-Management Alert, we found more duplicate loans. We
briefed the Administrator on August 10, 2020, about these potentially fraudulent loans. Shortly
afterwards, SBA informally implemented and strengthened some of its controls to address
vulnerabilities.
In addition to the other corrective actions SBA took on August 10, 2020, SBA also established a
new informal policy requiring loan officers to automatically decline any loan applications
flagged by the subcontractor for the following reasons:
• Suspicious online activity, device associated with fraud, high-risk IP addresses, or client
is international;
• Related deals by bank accounts that are not the same business or person;
• Email addresses and phone numbers in somebody else’s name; and
• Email addresses with periods that can be moved around (such as
“jo.hn.do.e@gmail.com”). 32
All such applications, including legitimate applications, if appealed by the borrower will be sent
to the loan application reconsideration process, which will require the applicant to provide
more supporting documentation.
29 SBA Email to Disaster Assistance Processing and Disbursement personnel, Duplicate and Related Logic, August 12, 2020
30 SBA OIG 20-16, Serious Concerns of Potential Fraud in EIDL Program Pertaining to the Response to COVID-19 (July 28,
2020).
31 SBA Informational Notice, Guidance Regarding Identification and Reporting of Suspicious Activity in the COVID-19 EIDL
Loan Program, July 22, 2020.
32 SBA Email to Disaster Assistance Processing and Disbursement Personnel, [Subcontractor] Procedure Update Number 1,
August 10, 2020
26
EIDL Data was Inaccurate and Incomplete. On August 20, 2020, we told SBA and
subcontractor officials that we have observed approved loans where the borrower’s name is
blank, “same,” “NA,” “not applicable,” or “not available,” in SBA Capital Access Financial System.
We asked the subcontractor how the system would identify and flag duplicate loans with these
borrower names. A subcontractor official claimed that the data in its system is accurate and this
might be a problem with the accuracy of the digital feed from subcontractor Number 2’s system
to SBA’s Capital Access Financial System.
We also explained that we have seen loan files with vague borrower names such as “Uber,”
“Lyft,” and“AirBNB,”as well as files in which the name field contains the borrower’s address,
year of birth, or other errors (See Table 9).
Table 9. Sample of Vague Borrower Names as of July 31, 2020
Number of
Borrower Namea Loans
Uber 1,148
Lyft 362
N/A 342
None 162
uber 160
UBER 148
Uber Driver 126
Independent Contractor 128
Uber driver 126
Uber Technologies 119
Doordash 117
Self employed 116
Instacart 109
NA 106
Self Employed 104
Source: OIG analysis of SBA Capital Access Financial System
a The borrower name field is case sensitive.
We asked how the system could verify the accuracy of information and identify potential fraud
with such unspecific data. Subcontractor and SBA officials were surprised by this issue and said
they would research it.
Additionally, we found 249,432 approved loans and 136 disbursed loans without any bank
account information. It is concerning these applications were approved without banking
information and based on the data, we are unable to determine where the loans were deposited.
Such inaccuracies in data will present challenges for SBA in servicing loans. SBA officials said
the agency has hired a major accounting firm to help fix data issues but did not explain exactly
what the firm is doing to accomplish the task. We do not know if the accounting firm is
addressing this issue or some other issue.
27
SBA should strengthen their controls further to lower fraud risk to an acceptable level. Without
better controls, loans to potentially ineligible borrowers reduce the amount of available critical
capital needed for eligible businesses to withstand the effects of the pandemic and increase the risk
of financial loss.
SBA should flag all loans deemed ineligible for its FY 2021 improper payments estimation process.
Recommendations
We recommend the Administrator to direct the Associate Administrator for Disaster Assistance to:
3. Review duplicate loans to IP addresses, email addresses, business addresses, and bank
accounts to determine if there are undisbursed funds that should be suspended until the
duplicate loans are assessed for eligibility.
4. Cancel all ineligible loans that are not disbursed, recover funds from all loans disbursed to
ineligible applicants, and flag those loans for the improper payments estimation process.
5. Strengthen or establish controls to ensure multiple loans are provided only to eligible
applicants and prevent the erroneous duplication of loans.
6. Strengthen data integrity to make it possible to determine if the inaccurate information
allowed loans to be made to ineligible entities and to strengthen SBA’s ability to service
loans appropriately.
28
Finding 3: SBA Approved Approximately $1.1 Billion in Loans
and Advance Grants to Potentially Ineligible Entities
We found that SBA approved 22,706 COVID-19 EIDLs totaling $917.7 million and 45,385 advance
grants totaling $135.1 million to potentially ineligible entities. In our July 2020 Management Alert,
we warned SBA that we had found approximately $250 million in approved loans to ineligible
entities. This finding is a continuation of that analysis.
The CARES Act requires that applicants had to be in business on January 31, 2020, to be eligible for
COVID-19 EIDLs or advance grants. 33 To determine if applicants were in business on January 31,
2020, we cross-referenced a database of Employer Identification Number (EIN) registrations made
between February 1,2020, and July 31, 2020, and matched them to data in SBA’s subcontractor
Number 2’s database as of August 5, 2020. We removed all sole proprietorships, because these
businesses could have been in operation for some time and be eligible for a COVID-19 EIDL even
though the EIN was registered after January 31, 2020
Of these applications, SBA approved 22,706 COVID-19 EIDLs totaling $917.7 million and
45,385 advance grants totaling $135.1 million to applicants with EIN registration dates of February
1, 2020, or later. In total, SBA approved nearly $1.1 billion to potentially ineligible applicants.
We believe this occurred because SBA did not require applicants to validate EIN registration dates.
Instead, SBA relied on the applicant to self-certify the “Date Business Established.” Applicants who
certified their entity existed before February 1, 2020, were then evaluated by a loan officer or team
lead. Loan officers or team leads searched the Internet to determine if a webpage indicated the
entity was in operation before February 1. If the loan officer or team lead found evidence, the
application was approved. If the loan officer or team lead did not find evidence, the processor
attempted to contact the applicant for evidence that the entity existed before February 1, 2020.
We believe an Internet search is not sufficient to determine business eligibility, because websites
can be fabricated to support the application. SBA should fully verify whether these entities were
legitimately in business on or before January 31, 2020, by using a government resource (state or
federal), and if they were not, SBA should recover the loan funds.
During this inspection, we also found that ineligible entities (such as “adult industry” businesses)
received COVID-19 EIDLs. In addition, SBA received fraudulent applications for prominent national
leaders that were obviously not legitimate applications and in one case paid the $5,000 advance
grant before denying the loan.
We also have received hotline complaints about identities being stolen and used for fraudulent
applications. For example, SBA received fraudulent loan applications in the name of a prominent
real estate developer, a major shoe manufacturer, and one of its own SBA District Office Directors.
SBA appropriately denied the loan for the real estate developer. However, SBA approved and
funded the fraudulent loan for the shoe manufacturer in the amount of $150,000. The agency also
approved but did not disburse the loan for its District Director because the director informed SBA
of the identity theft. SBA also terminated several employees for approving loans to themselves.
33 Public L. No. 116-136, Sec. 1110(c)
29
On August 14, 2020, SBA established a new policy, which stated if the subcontractor’s system was
unable to determine business eligibility through a public records search, loan officers should
attempt to verify the business eligibility through an Internet search. If the loan officer is unable to
locate a legitimate online presence for the business (not a website that looks like it was just created
for the purposes of obtaining a loan), the loan application should be declined.
Loans to potentially ineligible borrowers reduce the amount of available critical capital needed for
eligible businesses to withstand the effects of the pandemic and increase the risk of financial loss.
These loans also constitute improper payments under the Payment Integrity Information Act of
2019. 34 SBA should flag these loans for its FY 2021 improper payments estimation process.
Recommendations
We recommend the Administrator to direct the Associate Administrator for Disaster Assistance to:
7. Review the applicants with approved loans to determine if there are undisbursed funds
remaining that should be suspended until the business start date is verified and the
applicant is deemed eligible based on the CARES Act eligibility requirements. If the
applicant is deemed ineligible, recover any disbursed funds, deobligate any undisbursed
funds, and flag the application as ineligible.
8. Review the advance grants to determine if the application was legitimate and the business
met CARES Act eligibility requirements. If not, recover the funds and flag the application as
ineligible.
9. Revise the FY 2021 Improper Payments Act Checklist to include checking EIN dates for
COVID-19 EIDLs and advance grants or program the system to flag erroneously approved
loans and advance grants as improper payments; the information should be used during the
FY 2021 improper payments estimation process.
10. Strengthen controls for verifying an entity’s start date to ensure applicants meet eligibility
requirements.
34 31 U.S.C. §3351(4)
30
Analysis of Agency’s Response and Summary of Actions to Close
the Report
SBA management provided formal comments to the draft report. We have included those comments
in Appendix III. SBA management requested, and we agreed not to include the final appendix of
their response because it included confidential information such as corporate or individual
identities associated with IP addresses, business addresses, email addresses, and bank accounts.
Management disagreed with all the findings, partially agreed with recommendations 1 through 8
and 10, and disagreed with recommendation 9. We considered management’s comments when
preparing this final report.
OIG Analysis of Agency’s Response
SBA management’s comments assert that we do not provide enough evidence to prove that loans
were provided to ineligible businesses or potentially fraudulent entities, and that our analyses are
flawed. We strongly disagree. SBA attempts to diminish this review’s findings that point to internal
control weaknesses that our investigative results have confirmed.
OIG agrees that there are valid loans within the loan portfolio where there is little or no assurance
of fraud prevention or of eligibility; however, such examples provide a scant retort in context of the
billions of taxpayer dollars at stake. Notwithstanding, we recognize the significance of better
understanding and accounting for such instances in context of the internal control condition.
Unfortunately, SBA officials did not provide most of the information presented in their response at
any point during the inspection process. While it would have been helpful to have this information,
none of the information presented in SBA’s response alters our findings.
SBA’s management continues to insist that its controls are robust despite overwhelming evidence
to the contrary. Our analysis of SBA’s COVID-19 EIDL loan and application data highlights strong
indicators of ongoing fraudulent activity in the COVID-19 EIDL Program. These indicators are
backed by the following facts, which are strong indications that fraud has occurred on a large scale
and continues to worsen:
• OIG’s Investigation Division and other law enforcement agencies have already seized over
$450 million from more than 15,000 fraudulent COVID-19 EIDLs. OIG and other law
enforcement partners continue to seize additional fraudulent loan funds stemming from the
risk areas identified in this report.
• OIG’s Investigations Division and other law enforcement organizations have more than
5,000 loans under investigation, and new investigations are being initiated daily using the
risk profiles identified in this report.
In addition to criminal investigation, other government offices are seeking to assist the
victims of this fraud. For example, the Federal Trade Commission indicates it received
223,995 reports involving fraud, identity theft, and other concerns associated with the
nation’s pandemic response as of October 14, 2020. SBA management is aware that
numerous individuals’ identities were stolen and used to embezzle or attempt to embezzle
federal funds. Often when OIG finds one loan or grant based on a stolen identity, we find
numerous other applications, loans, or grants used by the same IP address, email address,
business address, or bank account.
31
At the same time FTC was reporting a spike in complaints, OIG was receiving an
unprecedented number of complaints to its Hotline. By August 31, 2020, we had received a
total of more than 42,000 hotline complaints. As of September 30, 2020, this total had
increased to more than 77,000 hotline complaints. Hundreds of complaints continue to
come in daily.
• Financial institutions across the country have contacted OIG about thousands of loans that
they believe to be suspicious because the deposits were made to account holders claiming
to use the funds to open a business, account holders attempting to transfer funds to foreign
accounts, and other suspicious banking activity. As a result, millions of dollars in COVID-19
EIDLs have been returned to SBA by financial institutions. SBA receives funds returned
from financial institutions on a regular basis.
• Two major financial institutions have fired hundreds of employees who were involved in
schemes to defraud the COVID-19 EIDL Program and have warned all their remaining staff
to report any instances of suspicious activity.
• SBA has fired employees and contractors who were involved in approving loans to
themselves or who inappropriately influenced loan approval.
Throughout this report, our analysis identifies the amount of potential fraudulent COVID-19 EIDLs
that SBA should review. We also provided some specific examples of suspect loans in each
subpopulation of loans to demonstrate the ongoing suspicious activity.
The agency must address our findings to mitigate considerable risk and address obvious
vulnerabilities in its internal control structure. The agency’s controls should be strengthened to
prevent such fraud and assure only eligible recipients receive relief funds.
The agency continues to advocate the reasons these indicators could represent eligible recipients,
while the fraudulent activity continues to rise, putting additional federal funds at risk. The existing
internal controls offer little or no assurance of eligibility or fraud prevention.
Because of the amount of federal funds at risk and the breadth of the ongoing fraud, OIG has
repeatedly alerted SBA of both ongoing and potential fraud in the COVID-19 EIDL Program. In July
2020, we briefed SBA and then issued a Management Alert warning SBA of potentially fraudulent
activity in its COVID-19 EIDL Program, which represented the “tip of the iceberg.” In August 2020,
we briefed SBA again about the vast size of the potentially fraudulent activity.
This report specifically identifies the expanse of the potential fraud ongoing in the COVID-19 EIDL
Program as of July 31, 2020. Even though we have repeatedly tried to sound the alarm with SBA, it
is concerning that SBA’s response to this report does not acknowledge the extent of ongoing fraud
or a willingness to undertake all necessary steps to identify and strengthen the existing ineffective
controls.
The potential fraud in the COVID-19 EIDL Program has continued to grow. Loan data from July 31,
2020 to September 30, 2020 indicates loans in the areas that we have identified continued to
increase, as shown in Figure 10.
32
Figure 10. Approved COVID-19 EIDLs for OIG Identified Subgroups
80
73.0
70
62.7
60
Billions of Dollars
50
40
29.9
30 26.7
16.5 18.2
20 14.3 15.4
10
0.9 1.5
0
Changed Bank Same IP Addresses Same Email Same Addresses Same Bank Accounts
Account Numbers Addresses
COVID-19 EIDL Subgroups
7/31/2020 9/30/2020
Source: OIG analysis of SBA Capital Access Financial System
We note there is overlap among these groupings of COVID-19 EIDLs applicants, so they should not
be added together. However, each overlap increases the likelihood of fraudulent activity.
We will continue to work with SBA management to ensure that proper controls are in place to mitigate
the considerable risk of fraud in the COVID-19 EIDL Program.
Summary of Actions to Close the Report
SBA management partially agreed to 9 of the 10 recommendations, and the proposed actions
generally satisfy the intent of the recommendations. The completion date for recommendation
numbers 1 through 8 and 10 is September 30, 2021. It is important to note that although
management stated they disagreed with the findings and only partially agreed with nine of the
recommendations, in most cases, they are taking corrective actions to fully implement the
recommendations.
The following list details the status of the recommendations and the actions necessary for OIG to
close them:
1. Resolved. Management partially agreed with our recommendation, stating they will
review a sampling of loans that had a bank account number changed before
disbursement and which did not pass through established bank account validations.
Management also stated they will forward any loans determined to be potentially
fraudulent to the OIG for further investigation and place undisbursed funds on Agency
Hold.
Although management only partially agreed with the recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
33
recommendation can be closed when management provides evidence that it conducted
a statistical sampling of the loans. The evidence should include the review timelines,
number of sampled loans, review steps performed, and the results.
2. Resolved. Management partially agreed with our recommendation, stating where
appropriate, SBA continues to work to expand and strengthen controls for the COVID-19
EIDL Program. Management agreed to strengthen controls to ensure loan deposits
continue to be made to legitimate bank accounts for eligible borrowers. Management
stated they will design and implement strategies and tools to respond to reports from
banks involving suspicious activity in connection with deposits of the COVID-19 EIDL
program.
Although management only partially agreed with the recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
recommendation can be closed when management provides procedural implementation
of the strategies and tools designed and the outcomes.
3. Resolved. Management partially agreed with our recommendation. Management stated
where appropriate, SBA continues to work to expand and strengthen controls for the
COVID-19 EIDL Program. Management stated it will review the loans associated with
the IP addresses, email addresses, business addresses, and bank accounts associated
with the greatest number of loans approved to determine if additional controls are
needed. In accordance with current protocols, SBA will forward any loans determined to
be potentially fraudulent to the OIG for further investigation and place undisbursed
funds on hold.
Although management only partially agreed with this recommendation, its proposed
actions satisfy the intent of the recommendation. This recommendation can be closed
when management provides evidence that it reviewed the loans or a valid statistical
sampling of the loans to determine if there are undisbursed funds that should be
suspended until the duplicate loans are assessed for eligibility.
4. Unresolved. Management partially agreed with our recommendation, stating it strongly
disagreed with the findings associated with the recommendation because the
methodology used for identifying potentially ineligible loans did not exclude legitimate
reasons why loans would have changed bank accounts or have duplicate IP addresses,
email addresses, business addresses, or bank accounts. However, management partially
agrees with the recommendation to continue following their current protocols to cancel
undisbursed loan funds if the applicant is determined to be ineligible and to forward to
the OIG for further investigation any loans identified as potentially fraudulent.
SBA’s response does not include recovering funds from all loans disbursed to ineligible
applicants and flagging those loans for the improper payment estimation process, as
recommended by OIG. As a result, management’s proposed actions do not fully satisfy
the intent of the recommendation. This recommendation can be closed when
management provides evidence that the agency cancelled all ineligible loans that were
not disbursed, recovered funds from all loans disbursed to ineligible applicants, and
flagged those loans for the improper payments estimation process, as recommended.
34
5. Resolved. Management partially agreed with our recommendation stating where
appropriate, SBA continues to work to expand and strengthen controls for the COVID-19
EIDL Program. Management also stated the agency will review the loans associated with
the IP addresses, email addresses, business addresses, and bank accounts associated
with the greatest number of loans approved to determine if additional controls are
needed. In accordance with current protocols, SBA will forward any loans determined to
be potentially fraudulent to the OIG for further investigation and place undisbursed
funds on Agency Hold.
Although management only partially agreed with this recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
recommendation can be closed when management provides evidence that the agency
strengthened or established controls to ensure multiple loans are only provided to
eligible applicants and prevent the erroneous duplication of loans.
6. Resolved. Management partially agreed with our recommendation, stating where
appropriate, SBA continues to work to expand and strengthen controls for the COVID-19
EIDL Program and partially agrees with the recommendation to strengthen data
integrity to ensure loans can be serviced appropriately.
Although management only partially agreed with this recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
recommendation can be closed when management provides evidence that the agency
strengthened data integrity to make it possible to determine if the inaccurate
information allowed loans to be made to ineligible entities and to strengthen SBA’s
ability to service loans appropriately.
7. Unresolved. Management partially agreed with our recommendation, stating where
appropriate, SBA continues to work to expand and strengthen controls for the COVID-19
EIDL Program. Management also stated the agency will explore developing and
implementing additional controls to validate the self-certified business start date.
However, SBA’s proposed actions do not satisfy the intent of the recommendation.
The recommendation can be closed when management provides evidence that the
agency reviewed approved loans to determine if there are undisbursed funds remaining
that should be suspended until the business start date is verified and the applicant is
deemed eligible under CARES Act eligibility requirements. If the applicant is deemed
ineligible, SBA should provide evidence that it recovered any disbursed funds,
deobligated any undisbursed funds, and flagged the application as ineligible or provide
evidence it implemented an alternative solution that satisfied the intent of the
recommendation.
8. Resolved. Management partially agreed with our recommendation. SBA stated it would
review a sampling of EIDL advances to determine if they were not provided to eligible
businesses. In accordance with current protocols, SBA will forward any EIDL advances
determined to be potentially fraudulent to the OIG for further investigation and place
undisbursed loan funds, if any, on Agency Hold. OIG considers the intent of the review is
to determine if the business met eligibility requirements for the loans.
35
Although management only partially agreed with this recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
recommendation can be closed when management provides evidence that the agency
reviewed a valid statistical sampling of the advance grants to determine if the
application was legitimate and the business met CARES Act eligibility requirements.
9. Unresolved. Management disagreed with our recommendation, stating it does not
agree with the recommendation to add EIN dates to the FY 2021 Improper Payments
Act Checklist for the COVID-19 EIDL program because EIN dates are not a conclusive
way to determine the business start date and have not been made available to SBA for
the purpose of processing COVID-19 EIDL applications at this point. However, SBA will
continue to explore alternative methods for validating the business start date.
Management also stated they do not agree with the recommendation to flag loans as
improper based on items that were not available at the time the loan was approved
added to a checklist after loan disbursement. OIG believes the loan files of applicants
identified during the audit as having EIN registration dates after January 31, 2020,
should be flagged for additional review during improper payment review for eligibility.
An EIN registered after the cutoff date is a potential indicator, even if not a conclusive
method of determination, that a business may not have been in operation on January 31,
2020. SBA should obtain EIN registration data from the Department of the Treasury and
document the loan files with the EIN registration dates outside the eligibility period to
ensure that if these files are selected during the improper payment estimation process,
potential ineligibility is considered.
This recommendation can be closed when management provides evidence the agency
revised the FY 2021 Improper Payments Act Checklist to include checking EIN dates for
COVID-19 EIDLs and advance grants or has programmed the system to flag erroneously
approved loans and advance grants as improper payments. Management should also
use the information during the FY 2021 Improper Payments Acts estimation process or
provide an alternative solution to satisfy the intent of the recommendation.
10. Resolved. Management partially agreed with our recommendation. SBA stated that the
agency will continue exploring alternative controls for validating the business start date
and evaluate the feasibility of adding those controls to application processing and
disbursement. Management also stated they made several attempts to gain access to
EIN dates obtained directly from the Internal Revenue Service (IRS), both before and
after the launch of the new streamlined COVID-19 EIDL application.
SBA’s response also said OIG had access to the same EIN dates from their counterparts
at IRS as SBA had requested but that, to date, OIG had been unwilling to share the
information with SBA’s Office of Disaster Assistance while simultaneously
recommending that SBA add it as a new internal control and retroactively apply it to the
improper payment analysis. We disagree with SBA’s assertion, because we provided the
necessary information on the potentially ineligible loans and grants as requested by SBA
for use in responding to this report.
We are unable to provide the EIN registration date information because of our data
sharing agreement with the U.S. Department of the Treasury. SBA can locate the EINs
associated with each application in its loan and grant data, and SBA should establish an
36
agreement with Treasury to get access to EIN registration dates, which SBA can use to
improve internal controls in its assessment of eligibility.
Although management only partially agreed with this recommendation, they are
implementing corrective actions that satisfy the intent of the recommendation. This
recommendation can be closed when SBA has provided evidence it strengthened
controls for verifying an entity’s start date to ensure applicants meet eligibility
requirements.
37
Appendix 1: Objective, Scope, and Methodology
This report presents the results of our inspection of SBA’s initial disaster assistance response to the
coronavirus pandemic. Our objective was to assess SBA’s initial disaster assistance response to
COVID-19, including staffing adequacy, loan application volume, timeliness of disaster approvals,
and customer service.
To meet our objective, we reviewed the following:
• Coronavirus Preparedness and Response Supplemental Appropriations Act
• Coronavirus Aid, Relief, and Economic Security Act
• Paycheck Protection Program and Healthcare Enhancement Act
• SOP 50 30 9 Disaster Assistance Program
• Office of Disaster Assistance Memo 20-17 Coronavirus Processing Changes, Memo 20-18
Coronavirus Processing Changes Number 2; and Memo 20-19 Coronavirus Collateral
and Insurance Changes
• Subcontractor Decision Guide
In addition, we interviewed officials of the Office of Disaster Assistance, field office personnel, and
employees of the contractor and subcontractor. We reviewed public documents issued by SBA,
including press releases, “Frequently Asked Questions,” and talking points. We also periodically
reviewed SBA’s COVID-19 Resources web page.
Finally, we obtained loan data from SBA’s ETRAN system and application data from the
subcontractor’s system. We attempted to assess the reliability of the data by performing limited
testing. However, SBA and its subcontractor did not provide source information to us to perform
data reliability testing. In addition, SBA acknowledged it has hired a vendor to research and correct
anomalies in its data. We found significant accuracy problems with the data, such as vague names
for the borrowers (See Table 9).
We determined that certain elements of SBA’s EIDL data that the agency used to manage its
program were not reliable because they were inaccurate, incomplete, or both. Specifically, we found
298 loans (117 Cancelled and 181 Active Undisbursed) that we could not tie back to an application
in subcontractor Number 2’s system, SBA’s application system, or SBA’s data warehouse. We also
found loans where the borrower’s name is blank, “same,” “NA,” “not applicable,” or “not available.”
Additionally, we found loan data with vague borrower names such as “Uber,” “Lyft,” and“AirBNB,”as
well as files in which the name field contains the borrower’s address, year of birth, or other errors.
Finally, we found 249,432 approved loans and 136 disbursed loans without any bank account
information. We provided SBA recommendations in this report to address the data reliability
issues.
As a result, the reliability of the data is undetermined, but it is the best available data, and SBA uses
the data to manage the program and derive program statistics. While we identified issues with the
data, we believe the data we reviewed was sufficiently reliable to support our report conclusions.
We conducted this performance-based inspection in accordance with the Council of the Inspector
General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. Those
standards require that we plan and perform the inspection to obtain sufficient, appropriate
38
evidence to provide a reasonable basis for our conclusions and observations based on our
inspection objective. We believe the evidence provides a reasonable basis for our conclusions based
on the inspection objective.
39
Appendix 2: Summary of Prior OIG Reports Related to the SBA’s
EIDL Disaster Assistance Response to COVID-19
SBA OIG has issued two reports this year related to SBA’s EIDL disaster assistance response to
COVID-19. Those reports are:
SBA OIG 20-16, Serious Concerns of Potential Fraud in EIDL Program Pertaining to the
Response to COVID-19 (July 28, 2020). In this Management Alert, we informed SBA that OIG had
been inundated with contacts to investigative field offices and the complaint Hotline. From the
inception of the COVID-19 EIDL and advance grant Programs from early March until May 19, 2020,
OIG received 465 hotline complaints. By June 26, 2020, the number of OIG hotline complaints had
increased to 1,038. Of these, 692 complaints were about potential fraud or scams
OIG received complaints of more than 5,000 instances of suspected fraud from financial institutions
receiving EIDL deposits. Nearly 3,800 of those reported instances of suspected fraud came from
only six financial institutions. An additional 1,220 reports of suspected fraudulent transactions have
come in from other financial institutions. Nine financial institutions have reported a combined total
of $187.3 million in suspected fraudulent transactions.
Our preliminary review revealed strong indicators of widespread potential fraud in the program.
Additionally, we found indications of deficiencies with internal controls related to disaster
assistance for the COVID-19 pandemic. Our review of SBA’s initial disaster assistance response
identified $250 million in COVID-19 EIDLs and advance grants given to potentially ineligible
recipients. We also found approximately $45.6 million in potentially duplicate payments.
OIG suggested swift management action to engage financial institutions immediately to identify
disbursements that may have been obtained fraudulently, recover disbursed funds, and prevent
additional taxpayer losses.
SBA OIG 20-12, Risk Awareness and Lessons Learned from Audits and Inspections of EIDLs
(April 30, 2020). In this White Paper, we shared information from previous audits and inspections
that SBA should consider in managing and reducing risks with pandemic-related loans. We pointed out
that we had found significant issues, as follows:
• SBA had issued EIDLs (as well as other disaster loans) without fully vetting borrower credit
or ability to repay.
• SBA had issued EIDLs (as well as other disaster loans) to businesses that had not sustained
a disaster-related economic loss and after the official time period of a particular disaster.
• SBA had a history of encountering challenges with inexperienced and untrained staff who
did not give accurate or appropriate assistance to borrowers during large-scale disasters.
40
Appendix 3: Management Comments
SBA RESPONSE TO INSPECTION REPORT
41
October 14, 2020
The Honorable Hannibal “Mike” Ware
Inspector General
U.S. Small Business Administration
409 3rd Street, SW
Washington, DC 20416
Dear Inspector Ware:
I write regarding the Office of Inspector General’s September 14, 2020 Draft Report, titled
“Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus
Pandemic” (“Draft Report”). I recognize OIG’s important role, and SBA remains ready to
receive and carefully consider OIG’s suggestions regarding the disaster assistance SBA is
providing in response to the Coronavirus pandemic. The Small Business Administration has
completed a careful and thorough examination of the Draft Report’s findings and
recommendations. I now take this opportunity to respond to the Draft Report.
I appreciate the Draft Report’s acknowledgement of the speed with which SBA began offering
pandemic-related EIDLs—on March 12, 2020, four days before any state formally was declared
a statewide COVID-19 disaster area. I also appreciate the Draft Report’s recognition that “SBA
has now approved and distributed more loans for COVID-19 relief than for all other disasters
combined in the agency’s history.” Indeed, the $211.8 billion in combined EIDL loans and
emergency advance grants that SBA has approved thus far is more than three times the total
amount of disaster loan funding that SBA previously has distributed during its entire 67-year
history. I also appreciate the Draft Report’s recognition that SBA has accomplished this historic
work volume on an extremely tight timeline as a result of legislation streamlining time-
consuming, upfront credit-based loan approvals and allowing applicants to request payment of
Advances within three days of application.
I am concerned, however, that the Draft Report does not fully and accurately portray SBA’s
highly successful delivery of an unprecedented volume of disaster assistance. Rather, the Draft
Report grossly overstates the risk of fraud, waste, and abuse in the COVID-19 EIDL program.
In particular,
42
• The Draft Report fails to acknowledge the enhanced and effective system controls and
validations that SBA is using to process COVID-19 EIDLs. Although legislation
removed certain controls to streamline loan processing, SBA implemented other, stronger
EIDL controls and validations. These rigorous controls and validations resulted in the
rejection of 5.1 million loan applications and prevented the disbursement of almost $184
billion in loans to ineligible entities. SBA has referred 80,965 COVID-19 EIDLs to
OIG’s criminal investigative division for further investigation. The Draft Report does not
credit these efforts or even remove the loans SBA already referred to OIG from the
number of “potentially fraudulent loans” that OIG claims have not been detected.
• The Draft Report’s findings and figures are inflated and rest on hasty, incomplete
conclusions. The Draft Report claims that SBA approved approximately $14.3 billion in
“potentially fraudulent loans” to accounts that differed from those listed on the loan
applications, approximately $62.7 billion in “potentially fraudulent loans” where
applications used duplicate information, and approximately $1.1 billion in loans and
advance grants to “potentially ineligible businesses.” But these numbers, as shown by
SBA’s analyses of the methodology OIG used and, where available, the source data, rest
on faulty assumptions. OIG largely failed to investigate whether the “potentially
fraudulent loans” raised more than the minimum quantum of suspicion. Indeed, as ODA
discovered, OIG often mischaracterized legitimate loan activity as “potentially
fraudulent.” For instance, all of the Draft Report’s “top 10” examples of shared IP
addresses and shared e-mail addresses, which OIG classifies as evidence of fraud,
involved loan applications by individuals who relied on certified public accountants, law
firms, loan packagers, or religious and cultural centers to submit their loan applications.
Likewise, all of the Draft Report’s “top 10” examples of physical addresses being
associated with multiple loans, which again OIG classifies as evidence of fraud, involved
independent contractors using on their loan applications the physical addresses of the
corporate headquarters or regional offices of the companies for which they work. More
than 82 percent of the applications with duplicate physical addresses were made by
taxicab, ridesharing, and food delivery drivers. And most of the “top 10” examples of
loans with shared bank accounts involved multiple rental properties incorporated and
managed by single individuals who did not maintain separate bank accounts for each of
their properties. In short, OIG mistakenly identifies legitimate loans and advances as
examples of “potential fraud” and “potential ineligibility” because OIG did not complete
its analyses. Yet, the Draft Report touts figures that erroneously count these legitimate
loans and advances as fraud.
In the attached memorandum—which I request that you reproduce in full (except for the
confidential second appendix), along with this cover letter, in your final report—SBA
supplements and corrects much of the Draft Report’s information. Where available, SBA
conducts the analyses of the source data that OIG stopped short of conducting. These
supplements and corrections are necessary to ensure that the Draft Report fully and accurately
portrays both SBA’s historic and tireless work to provide rapid disaster assistance to eligible
recipients adversely impacted by the Coronavirus pandemic and the measures SBA has taken to
mitigate the risk of fraud, waste, and abuse.
43
Indeed, OIG acknowledged that it has not conducted a review of the individual loans on which it
bases the Draft Report’s findings, which is the only way to accurately assess the true extent of
fraud in the EIDL program. As you testified before the House Small Business Subcommittee on
Investigations, Oversight and Regulations on October 1 2020, “[OIG’s] report[] speaks to
significant potential fraud in . . . EIDL. It is remarked as ‘potential’ only because we have not
reviewed each loan associated with the area of finding . . . .” SBA picked up where you left off.
Where possible, we conducted our own review of the loans associated with each of the Draft
Report’s findings. This more rigorous analysis—which you concede OIG has not conducted—
shows that much of what OIG labels in the Draft Report as “potentially fraudulent” or
“ineligible” loan activity is in fact legitimate efforts by eligible businesses to obtain disaster
assistance. SBA’s analysis fatally undermines much of the Draft Report’s findings and shows
that the Draft Report has significantly overstated the extent of “potential” COVID-19 EIDL
fraud.
Sincerely,
Jovita Carranza
44
Memorandum
To: Inspector General Mike Ware
From: James Rivera, Associate Administrator, Office of Disaster Assistance
Re: September 14, 2020 Draft Report: Small Business Administration’s Initial Disaster
Assistance Response to the Coronavirus Pandemic
The Draft Report Overlooks the Significant and Successful Internal Controls that SBA Has
Put in Place and, Even Taking Its Inflated “Potential Fraud” Figures at Face Value, Fails to
Discount Them with the Referrals that SBA Has Made to OIG.
The Draft Report asserts that, “[t]o expedite the process, SBA ‘lowered the guardrails’ or relaxed
internal controls, which significantly increased the risk of program fraud.” While legislation did
indeed take certain control measures off the table, the Draft Report’s assertion disregards the
numerous enhanced control measures that SBA instituted to handle the influx of COVID-19-
related EIDL applications and fails to account for their success.
1. To process COVID-19-related EIDL applications, SBA launched a new streamlined
application that handled loan intake, processing, and closing for millions of applications.
Historically, the disaster loan program’s strongest internal control is the ability to receive directly
from the IRS recent tax transcripts. The CARES Act removed that control. However, SBA
leveraged technological solutions to add dozens of novel validations and internal controls to the
new streamlined application process.
Indeed, SBA’s system controls and validations have been strengthened far beyond the
recommendations included in OIG’s July 28, 2020 management alert; they include over a dozen
that are new; and, as detailed infra, they have proven highly effective in detecting and preventing
potentially fraudulent loans and loans to potentially ineligible applicants. The system controls
and validations for COVID-19 EIDL loan and advance processing include the following
(controls that are new and in use specifically for COVID-19 EIDL are noted with an asterisk):
Data Validation & Controls:
• Intake Application form field validations for correct data types and completeness
• Intake form user input review prior to submission
• Applicant data submission certification requirement
• Identity information application velocity check*
• Identity Information validation*
• Email address validation*
• Phone number validation*
• User identity validation with out of wallet questions*
• Public records lookups
• Bank account data validation check*
• Bank account ownership check*
• IP address and device screening*
45
• Credit report for score and fraud flags
System Decision Controls:
• Duplicate application detection
• Related application linking on multiple data attributes*
• Red flag alerts for data attributes indicating potential for suspicious activity*
• ODA Rule of Two requirement for loan approval
• 70+ business rules to determine business eligibility & loan/advance amounts*
• Role-based approval restrictions
• Role limited reconsideration workflow
• User restricted failed disbursement processing
• User action logging and notes updates
•
System Access and Workflow Controls:
• Segmented Workflows with Role Access Limitations
• Two-Factor Authentication
• Multiple failed login attempt lockouts
• IP Address velocity restrictions and blocking*
• Bank account update access tokenization (Advance Reconsideration)*
Network & Application Security:
• Azure Front Door – MSFT threat intelligence and identification to guard against SQL
injection and other malicious hacking attempts
• Azure – Network Security Group IP rules
• Rapid Server Level Firewall Rules
• Webroot Secure – Server level endpoint protection
• Application level rules – IP blacklisting & whitelisting, User level behavioral blocking,
cross site scripting controls, permission based user access to only associated active
applications
• Data encryption at rest (MSFT TDE) and in transit (TLS 1.2)
Attack Mitigation and Security Monitoring:
• Azure Defender Security Center - Intrusion detection, vulnerability assessment and
overall environment monitoring
• Azure DDOS protection
• OCIO Penetration Testing
•
These system controls and validations continuously have been updated, as warranted, throughout
SBA’s delivery of COVID-19 disaster assistance. Major system enhancements include the
following (validation and controls enhancements noted by an asterisk):
46
Date Enhancement(s)
March 29 EIDL COVID-19 Application Intake Form Launched*
April 6 Applicant Portal & Loan/Advance Decisioning Platform Launched*
April 24 Assigned Task Username Display*; Fully Rendered Credit Report*;
Additional Permissions for Batch Approval*; User Creation Enhancements*;
Display Bank Info Validation Errors to Users*; Loan Resizing; Additional
Phone and Email Validations*; Letter Enhancements; Ownership Percentage
Validations*
April 30 Accept Agricultural Entity Applications; Advance Express Grant Machine;
Post Loan Approval Advance Funding*; Enhanced LO Display of
Unvalidated Bank Info*
May 6 Create Obligating and Funding Error Tasks*; Contact Info Data Processing
Enhancements*; Enhanced Field Validations*; Decline Letter & Email
Enhancements; Update to EI Formula*; Increase Server Capacity; Add
Account Ownership to CBR*
May 19 Intake Form Additional Field Validations*; Application Search Filtering
Enhancements*; Pass Non-Profit Flag to ETRAN*; Routing Number
Validation on Intake Form, Client Portal & ETRAN*; Enhanced SSN
Validation*; ZIP Code to State Validation*; System Performance
Enhancements; Signatory Enhancements*; Client Portal Help Enhancements
June 3 Email Reminders for Inactivity; Advance Reconsideration Portal*; Additional
Data Modification Restrictions based on Stage and Role*; Display Funded
Status; Create Funding Hold Checkbox*; Interest Rate Validation for Entity
Type Changes*; System Text Updates
June 18 Auto-Disposition Inactive Applications*; Add Loan Disclosure Language;
Task Search Capability*; LA&A Updates, Allow Funding Hold at Any
Stage*; Default Check Advance Request Box; Client Portal Text & Display
Changes
July 9 Advance Recon for Non-Request Applicants*; ETRAN Interaction and Notes
Enhancements*; Invalid Email Error Handling*; Enhanced Bank RTN
Validation*; Loan & Advance Amount Exceptions with Permission
Limitations*; Tax ID/Entity Type mismatch logic and LO Messaging*; Client
Portal Text Modifications
July 30 Intake Form Modifications; Intake Form Field Validation Enhancements*;
Advance Decision History*; Notes for Historic ETRAN Errors*; Automated
ETRAN Error Daily Monitoring*; Bulk Document Upload with Notes*;
Enhances Email Syntax Validations*
August 14 Task for Unsigned Closing Docs; Advance Decision History in Notes*;
Decision Engine Label Text Changes*; Bank info History Table*; Tracking
and Notes for Application Hold Actions*; Additions to Decline Reasons
September 2 Intake App Lookup Screen*; Text Edits for Loans >$200K; Enable Funding
Hold at Any Stage*
September 15 Loan Reconsideration Process Phase 1*; Update Decline Letter Functionality
October 8 Multifactor Authentication Enhancements*; Servicing Office Update*; Loan
Reconsideration Process Phase 2*
47
2. SBA’s robust front-end controls were supplemented by back-end measures to detect instances
of suspected fraud. On June 3, certain SBA personnel were given the capability to hold funding
on EIDL loan and advance files with suspected fraud. On June 28, two fraud-reporting e-mail
boxes were established to enable SBA personnel to report suspected fraud to the team charged
making OIG referrals. In July, that team received additional staffing. And on July 22, 2020, SBA
proactively issued to all lenders and SBA staff an EIDL suspected fraud notice. That notice
alerted depository financial institutions to the potential for suspicious activity related to COVID-
19 EIDL funds deposited into business or personal accounts and provided points of contact at
SBA for those institutions to report such activity. Along with directing lenders to OIG’s
complaint submission form, SBA established an e-mail address for lenders to report suspected
fraud to ODA and made them aware of an already-existing team at the Processing and
Disbursement Center that would be monitoring the mailbox and investigating applications,
placing applications on agency hold, and reporting cases of suspected fraud to OIG’s criminal
investigative division.
3. The Draft Report makes several missteps in asserting that these robust internal controls
constituted a lowering of the guardrails. First, in asserting that “SBA abandoned the rule of two,”
the Draft Report gives short shrift to the first-tier automated review process that SBA instituted.
Before manual review, each application was subjected to a robust automated internal control
process. This two-tiered, automated-then-manual review—necessitated by the unprecedented
influx of EIDL applications—leveraged both human and technological resources and provided at
least as robust a control as two tiers of manual review. In arguing otherwise, the Draft Report
claims that “SBA employees could potentially see trends in fraudulent applications that a system
potentially could not identify.” However, the Draft Report provides no support for the
counterintuitive notion that individuals manually examining individual applications can spot
trends that an algorithm cannot.
The Draft Report also takes issue with SBA’s timing goals for loan decisions, calling SBA’s
manual reviews “cursory.” This characterization yet again declines to recognize that manual
review occurred only after an automated review that employed robust internal controls and
validations.
In addition, the Draft Report notes some actions that SBA took to address OIG’s July
management alert on duplicate loans. However, the Draft Report neglects to acknowledge that
SBA already was taking actions to address the issue. On June 18, SBA’s contractor put into place
various additional controls, including a “hold” feature, related to fraud prevention. Moreover, a
subsequent July 9 build put in place additional bank validation checks. These builds were
implemented prior to the management alert. In any event, the later actions that SBA took in
response to the management alert are an example of the successful, cooperative partnership
between SBA and OIG.
4. In the following sections, SBA demonstrates that the Draft Report’s analyses suffer from
significant errors, causing it to erroneously label “potentially fraudulent” or “potentially
ineligible” many legitimate EIDL loans and advances. But putting aside those significant
errors—and taking at face value the Draft Report’s conclusion that certain loans and advances
were potentially fraudulent—it fails to account for the successes of SBA’s enhanced internal
controls, and for the loans that SBA has on its own initiative referred to OIG’s criminal
investigative division for further investigation.
48
Not including declines for low credit score or lack of economic injury, as of September 30, 2020,
SBA’s system controls and validations helped to reject over 5.1 million loan applications and
stop almost $184 billion from being disbursed to ineligible entities. Moreover, as of September
30, SBA has placed 80,965 COVID-19 EIDL loans on agency hold and referred them to OIG’s
criminal investigative division for further investigation. Of those potentially fraudulent or
ineligible loans placed on agency hold, 33,590 (almost $1.7 billion in COVID-19 EIDL loan
funds) were never disbursed. And of the disbursed loans placed on agency hold and referred to
OIG, 15,284 loans (over $753 million in COVID-19 EIDL loan funds) were returned to SBA.
In reporting figures on what it labels “potentially fraudulent loans” and “loans to potentially
ineligible businesses,” the Draft Report both fails to place its figures into context (by
acknowledging the far greater amount of loan funds that SBA’s system controls and validations
helped to decline) and fails to discount its figures by the loans that SBA has placed on agency
hold and referred to OIG for investigation. Thus, even taking at face value the Draft Report’s
figures—which the following sections firmly cast into doubt—those figures do not paint a
complete and accurate picture of the success of SBA’s system controls and validations.
The Draft Report Overlooks that SBA Created a Process for Updating Bank Account
Information, Subject to Strong Internal Controls, and Fails to Acknowledge the Legitimate
Reasons Why Applicants May Change Their Bank Account Information.
As its first finding, the Draft Report asserts that “SBA approved $14.3 billion in potentially
fraudulent loans to accounts that differed from the original bank accounts listed on
applications[.]” OIG did not provide to SBA the source data for this finding, so SBA has not
been able to review the individual loans associated with this finding. But in any event, the Draft
Report overlooks that, in many instances, bank account information was changed with SBA’s
knowledge and pursuant to a controlled process that SBA established. Moreover, the indicators
that the Draft Report deems particularly suspicious are entirely consistent with legitimate loan
and advance activity.
1. A part of ODA’s internal controls are its connection to third-party bank account validation
services. This internal control allows ODA to confirm whether bank account information
(routing number, account number, EIN of business, address of business, SSN of individual,
address of individual, name on account) matches the information provided on the application.
Throughout the COVID-19 EIDL process, ODA confirmed banking information prior to advance
disbursements and, later, loan disbursements.
The banking validations and internal controls that SBA established to process EIDL advances—
part of the fully automated process necessary to accommodate the CARES Act’s 3-day funding
provision—were extremely effective at detecting inconsistencies between the business applicant
and the listed bank account information. As a result, millions of potentially eligible businesses
did not receive the EIDL advance in the first round of processing. SBA reviewed the underlying
validation issues that were preventing the applications from moving forward to disbursement and
determined that many applicant businesses entered bank account and routing numbers with
minor errors or used personal bank accounts instead of a business bank account.
On June 3, 2020, SBA began sending e-mail communications to more than 2 million applicants
that had requested but did not receive the EIDL advance due to business information or bank
account validation failures. The e-mail informed the affected applicants that SBA was unable to
successfully verify and validate all of the information in the application to process the EIDL
49
advance, and it invited them to update the application with corrected business and bank account
information. Updated advance applications were then run through the same set of validations and
internal controls used to process all other EIDL advance applications. Ultimately, SBA
successfully approved over $1 billion in EIDL advance funds to more than 338,000 businesses
that updated their information and passed the business and bank validations, while second-
attempt validation failed more than 761,000 times.
The Draft Report’s finding that SBA approved loans with a bank account that was changed from
the original application neglects the important fact that SBA, with the goal of quickly providing
struggling small businesses with needed funding, invited more than 2 million applicants to
update their application information, including, under certain circumstances, changing the bank
account information. And it fails to appreciate that these updated applications underwent SBA’s
robust system controls and validations.
2. The Draft Report acknowledges that minor changes—for example, correction of typographical
errors, or switching the bank account and routing numbers—were not suspicious. Nonetheless, it
deems “highly suspicious” those instances when bank account numbers were significantly
different, routing numbers were for entirely different banks, and the change was to an online-
only debit-card financial institution rather than a checking account at the original brick-and-
mortar bank. These scenarios, however, are entirely consistent with legitimate application
activity.
Advance applicants often had legitimate cause to provide different accounts, including accounts
with different banks. As described above, SBA has determined that many otherwise eligible
applicants initially had their applications rejected because they used personal bank accounts
instead of a business bank account. SBA’s reconsideration process allowed for corrections of
such an innocent error. And correction of such an error would involve submission of a
significantly different bank account number, even one from a different bank. Likewise, in
instances when an applicant may have closed its business bank account and opened one at
another banking institution (due to any number of legitimate reasons), the update would involve
submission of a significantly different account number. Thus, the fact that a bank account
number significantly differed between an initial and an updated application—and even may have
been associated with a different bank—is not itself “highly suspicious.” It is entirely consistent
with an applicant correcting submission of a personal bank account with submission of a
business bank account, or closing its business bank account and opening one elsewhere.
Likewise, that the change might be from a brick-and-mortar bank account to an account at an
online-only financial institution is not itself suspicious. The Draft Report not only fails to
elaborate on its assertion to the contrary; it also fails to acknowledge the impact that the
pandemic, stay-at-home orders, and business closures had on consumer activity. It is not
surprising that during a time when many Americans are staying home on the advice of public-
health officials or the orders of public authorities, online-only banks would see an increase in
new account openings versus brick-and-mortar banks. Otherwise eligible applicants that, in their
initial application, erroneously used a personal bank account rather than a business bank account,
or applicants that closed their business bank account after their initial application, thus had ample
cause to look to online-only banking institutions rather than brick-and-mortar ones.
50
3. Based on its significantly flawed first finding, the Draft Report first recommends that SBA
“[r]eview all loans that had a bank account number changed from that shown on the original
application to determine if the changes were legitimate or fraudulent. If not legitimate, work to
recover the funds, deobligate any undisbursed funds, and refer to the OIG.” As detailed above,
SBA strongly disagrees with the finding associated with this recommendation because there was
insufficient evidence that loans should be considered potentially fraudulent based on a changed
bank account. However, where appropriate, SBA continues to work to expand and strengthen
controls for the COVID-19 EIDL program and partially agrees with the recommendation to
review a sampling of loans that had a bank account number changed prior to disbursement which
did not pass through the established bank account validations. In accordance with current
protocols, SBA will forward any loans determined to be potentially fraudulent to the OIG for
further investigation and place undisbursed funds on Agency Hold.
The Draft Report next recommends that SBA “[e]stablish or strengthen controls to ensure loan
deposits are made to legitimate bank accounts for eligible borrowers only.” Again, SBA strongly
disagrees with the finding associated with this recommendation. However, where appropriate,
SBA continues to work to expand and strengthen controls for the COVID-19 EIDL program and
partially agrees with the recommendation to strengthen controls to ensure loan deposits continue
to be made to legitimate bank accounts for eligible borrowers. SBA will design and implement
strategies and tools to respond to reports from banks involving suspicious activity in connection
with deposits in the COVID-19 EIDL program.
The Draft Report Overlooks the Legitimate Reasons Why Applicants Commonly Use Shared
IP Addresses, E-mail Addresses, Business Addresses, and Bank Accounts, and SBA’s
Analyses of the Source Data Show that the Draft Report Drastically Overstates the Incidence
of EIDL Fraud.
The Draft Report next finds that “SBA approved billions of dollars in potentially fraudulent
loans to applicants using duplicate information (IP addresses, email addresses, business
addresses, and bank accounts)[.]” However, SBA’s analyses of the underlying source data reveal
that most of what the Draft Report labels “potential fraud” is, instead, legitimate loan activity.
The Draft Report’s contrary conclusions rest on both a failure to acknowledge the many
legitimate reasons why applicants used duplicate loan information and a failure to adequately
investigate the individual loans associated with its finding.
1. The Draft Report includes a sampling of the top 10 IP addresses receiving most multiple loans
(see Table 5), but the IP addresses are redacted to protect personally identifiable information.
OIG provided to SBA the source data, including the individual IP addresses associated with the
borrowers in Table 5. SBA researched each IP address and found that addresses 2–10 belonged
to law firms, loan packagers, and certified public accountants (CPAs). SBA attempted to contact
all of the borrowers by phone, and where SBA established contact, all confirmed that they
employed the services of attorneys, accountants, and other representatives in order to apply for
COVID-19 EIDL assistance. In most cases, the borrowers reported they were concerned about
making mistakes on their application, so they used professionals to ensure timely and accurate
loan consideration. One of the IP addresses belongs to a branch of a large consumer/commercial
bank that serves customers across the South, Midwest, and Texas. SBA contacted the branch,
and a bank representative confirmed that the bank helped over 150 business customers apply for
51
COVID-19 EIDL assistance. In other words, SBA’s analysis confirms that these uses of shared
IP addresses were legitimate, not fraudulent.
SBA’s analysis of OIG’s source data also showed that the remaining IP address—the one with
the greatest number of approved loans cited in Table 5—is associated with a WiFi belonging to a
religious or cultural center in Brooklyn, New York. This is not surprising given the
unprecedented and widespread impact the pandemic has had on communities nationwide. Small
businesses often seek additional help for relief programs through trusted community resources
such as chambers of commerce, churches, and cultural centers. The reasons could vary from
simply needing internet access in order to submit applications to needing language assistance,
but whatever the reason, use of a religious or cultural center’s WiFi does not indicate a high
probability of fraud as claimed in the Draft Report.
2. The Draft Report also includes a sampling of the top 10 e-mail addresses receiving the greatest
number of multiple loans (see Table 6), but the e-mail addresses are redacted. SBA analyzed the
source data used for Table 6 and found legitimate cause for each of the associated e-mail
addresses to receive multiple loans, yet again undermining the Draft Report’s findings. All of the
e-mail addresses associated with the list of borrowers in Table 6 belong to CPAs, law firms, and
tax preparers who submitted COVID-19 EIDL applications on behalf of their clients. Further
underscoring the legitimacy of the loans associated with these e-mail addresses, and further
demonstrating the flaws in the Draft Report’s analysis, the sampling of duplicate e-mail
addresses significantly overlaps with the legitimately used IP addresses that are compiled in
Table 5.
3. Table 7 includes a sampling of the top 10 physical addresses receiving the greatest number of
multiple loans. Here again, the Draft Report’s assertions of impropriety do not withstand
scrutiny. SBA’s review of the source data revealed that the duplicate physical addresses are for
corporate headquarters or regional offices entered by independent contractors—an entirely
unremarkable result that does not suggest fraud. Half of the addresses that the Draft Report cites
belong to taxicab companies, and another three addresses are variations of a ridesharing and food
delivery company’s corporate headquarters. Altogether, taxicab, ridesharing, and food delivery
drivers applying as independent contractors for COVID-19 EIDL assistance account for more
than 82 percent of the duplicate addresses cited in the Draft Report. SBA reviewed a sampling of
the loan authorization and agreements for loans under all 10 duplicate addresses and found that
all of them were signed by individual loan borrowers in accordance with disaster loan rules and
regulations.
4. The Draft Report also includes a sampling of the top 10 bank accounts that received multiple
loans (see Table 8). Here again, the Draft Report’s analysis of the data is incomplete and fails to
account for important details about the businesses associated with the bank accounts. A look at
the source data shows that most of the bank accounts associated with multiple loans are for
legitimate business reasons, and their use for multiple loans does not constitute fraud or improper
activity. For example, most of the loans identified in Table 8 were provided for rental properties
that are incorporated and managed by individuals. That landlords and rental property owners
might have EIDL loans associated with multiple properties deposited into a single bank account
is unremarkable. Landlords and rental property owners often use a single bank account to
manage finances for multiple properties, and they are eligible for EIDL assistance for lost rents
on each property. Thus, their use of a single bank account is not an indicator of fraud.
52
5. The Draft Report also includes, in Table 9, a sampling of the top 15 borrower names with
multiple loans. The few thousand loans out of 3.6 million loan approvals with common names
may at first blush appear unusual, but here again, there is a simple and logical explanation that
appears upon minimal additional investigation. More than half of the business names in Table 9
are some variation of a ridesharing and food delivery company and were used by independent
contractors who likely were unsure whether to include their name or the name of the company.
SBA conducted a detailed analysis of the loans associated with Table 9 and confirmed that the
loan authorization and agreement for the approved loans were signed by individuals and funded
to individual bank accounts. In other words, the loans were approved and disbursed in
accordance with SBA’s rules and regulations and there is no indication of fraud or improper
activity.
6. Based on its significantly flawed second finding, the Draft Report recommends that SBA
“[r]eview duplicate loans to IP addresses, email addresses, business addresses, and bank
accounts to determine if there are undisbursed funds that should be suspended until the duplicate
loans are assessed for eligibility.” As detailed above, SBA strongly disagrees with the finding
associated with this recommendation because there was insufficient evidence that loans should
be considered potentially fraudulent based on duplicate IP addresses, e-mail addresses, business
addresses, or bank accounts for multiple loans. However, where appropriate, SBA continues to
work to expand and strengthen controls for the COVID-19 EIDL program and partially agrees
with the recommendation to review the loans associated with the IP addresses, e-mail addresses,
business addresses, and bank accounts associated with the greatest number of loans approved to
determine if additional controls are needed. In accordance with current protocols, SBA will
forward any loans determined to be potentially fraudulent to the OIG for further investigation
and place undisbursed funds on Agency Hold.
The Draft Report next recommends that SBA “[c]ancel all ineligible loans that are not disbursed,
recover funds from all loans disbursed to ineligible applicants, and flag those loans for the
improper payments estimation process.” Again, SBA strongly disagrees with the finding
associated with this recommendation. However, where appropriate, SBA continues to work to
expand and strengthen controls for the COVID-19 EIDL program and partially agrees with the
recommendation to continue following our current protocols to cancel undisbursed loan funds if
the applicant is determined to be ineligible, and to forward to the OIG for further investigation
any loans identified as potentially fraudulent.
The Draft Report next recommends that SBA “[s]trengthen or establish controls to ensure
multiple loans are provided only to eligible applicants and prevent the erroneous duplication of
loans.” Again, SBA strongly disagrees with the finding associated with this recommendation.
However, where appropriate, SBA continues to work to expand and strengthen controls for the
COVID-19 EIDL program and partially agrees with the recommendation to review the loans
associated with the IP addresses, e-mail addresses, business addresses, and bank accounts
associated with the greatest number of loans approved to determine if additional controls are
needed. In accordance with current protocols, SBA will forward any loans determined to be
potentially fraudulent to the OIG for further investigation and place undisbursed funds on
Agency Hold.
The Draft Report next recommends that SBA “[s]trengthen data integrity to make it possible to
determine if the inaccurate information allowed loans to be made to ineligible entities and to
strengthen SBA’s ability to service loans appropriately.” Again, SBA strongly disagrees with the
53
finding associated with this recommendation. However, where appropriate, SBA continues to
work to expand and strengthen controls for the COVID-19 EIDL program and partially agrees
with the recommendation to strengthen data integrity to ensure that loans can be serviced
appropriately.
The Draft Report’s Finding that SBA Approved EIDLs and Advance Grants to Ineligible
Entities Wrongly Equates Having an EIN with Being in Business and Fails to Account for the
Legitimate Reasons Why Eligible Businesses May Register EINs After January 31, 2020.
In its third finding, the Draft Report asserts that “SBA approved approximately $1.1 billion in
loans and advance grants to potentially ineligible entities.” The Draft report explains that, “[t]o
determine if applicants were in business on January 31, 2020, we cross-referenced a database of
Employer Identification Number (EIN) registrations made between February 1, 2020, and July
31, 2020, and matched them to data in SBA’s subcontractor Number 2’s database as of August 5,
2020,” then “removed all sole proprietorships.” This analysis—which equates having an EIN
with being in business—underpins the Draft Report’s conclusion that 22,706 EIDL loans and
45,385 advances were approved to potentially ineligible businesses. The Draft Report’s shallow
analysis fails to account for the legitimate reasons why eligible businesses in operation by
January 31, 2020—and not just sole proprietors—may have registered EINs after that date.
1. The equivalence that undergirds the Draft Report’s finding is a false one, as there are many
reasons why a business in operation on or before January 31, 2020, might register an EIN after
that date.
Generally, EINs are required if the business has employees; operates as a corporation or
partnership; files employment, excise, or alcohol, tobacco, or firearms tax; withholds taxes on
income, other than wages, paid to a non-resident alien; or has a Keogh plan. Businesses often
incorporate during tax preparation season in anticipation of filing their returns. Indeed, there are
several legitimate reasons why a business required to have an EIN and already in operation on
January 31, 2020, might register an EIN after that date. These reasons include, for example:
• Recently formed, covered businesses prepare to enter their first tax year.
• Recently sold, covered businesses prepare to enter their first tax year after the change in
ownership.
• A corporation receives a new charter.
• A subsidiary of a corporation is using the parent corporation’s EIN.
• A new corporation is created after a statutory merger.
The Draft Report also fails to acknowledge that businesses other than sole proprietors—
independent contractors, for example—may not have been required to register EINs but may
nonetheless have chosen to do so. There are many reasons why a business already in operation
but not required to register an EIN might nonetheless choose to register one. These reasons
include:
54
• EINs may help separate personal and business finances and limit liability in case of a
lawsuit.
• EINs may be used to file business taxes and avoid tax penalties in case a business has
erroneously determined that it was not required to register an EIN.
• Tax advisors may suggest that certain business tax deductions are less likely to be audited
by the IRS if filed using an EIN.
• Use of an EIN may be an effective way to protect against identity theft because it
separates personal and business finances and allows one can avoid using an SSN.
• Use of an EIN may add credibility to businesses operating as freelancers or independent
contractors.
• Businesses may prefer to hire independent contractors using an EIN to make clear that
they are not employees.
• Having an EIN may improve chances that vendors will work with independent
contractors because they enable business credit checks.
• Some wholesale distributors may require that retailers have EINs.
• For other forms of business lending, use of an EIN may expedite the process. Banks may
not require an EIN for the business loan, but they do require a business bank account, and
for most lending institutions, one must have an EIN to obtain a business bank account.
• Having an EIN may help build business credit.
In short, the equivalence between having an EIN and being in business is a false one. Indeed, the
Draft Report briefly acknowledges its own logic gap. In a footnote, the Draft Report admits that
“[t]hese businesses could have been in business for some time and be eligible for a COVID-19
EIDL even though the EIN is dated after January 31, 2020.” Nevertheless, without any apparent
investigation into the underlying reasons why they registered EINs after January 31, 2020, the
Draft Report proceeds to label “potentially ineligible” all of the applicants with such EINs. In
other words, the Draft Report admits that further inquiry may well clear up doubts regarding
these applicants’ eligibility, but it nonetheless fails to conduct any such further inquiry. The
admitted incompleteness of the audit’s inquiry thus casts significant doubt on the Draft Report’s
finding.
2. Even putting aside the false equivalence on which its finding rests, the Draft Report faults
SBA for failing to investigate data to which OIG has denied it access. SBA has made several
requests to gain access to the same database of EIN registrations that OIG used for the Draft
Report and its investigative activities; however, OIG repeatedly has denied those requests.
Dating back as far as April 8, 2020, SBA was working with representatives from the SBA OIG
Investigations Division and the U.S. Treasury Inspector General for Tax Administration
55
(TIGTA) to obtain access to the EIN registration database. TIGTA advised representatives from
SBA’s Office of Disaster Assistance (ODA) that TIGTA was willing to share with ODA the
requested information, which could be used to identify businesses with recently registered EINs
so further validations could take place. The EIN data were instead provided to the SBA OIG, and
OIG has refused SBA’s repeated requests to share the information with ODA. SBA recently
requested a listing of the 22,706 loans with EINs registered after January 31, 2020, so SBA could
validate the Draft Report’s findings, but once again, OIG’s audit team refused to share the
information with SBA’s teams. It is unreasonable for the Draft Report to claim that it has taken
extraordinary steps to warn SBA of the potential for fraud based on EIN registration dates while
at the same time withholding that same information from the program office responsible for
administering the EIDL program.
3. The Draft Report also gives short shrift to the legislatively imposed restraints within which
SBA has operated. The Draft Report correctly states that for an applicant to be eligible for EIDL
assistance, it had to be in operation on or before January 31, 2020. SBA normally requires all
disaster loan applicants to sign and return an IRS Form 4506-T as an application filing
requirement, thus allowing SBA to obtain tax transcripts directly from the IRS. Businesses and
nonprofit organizations also typically are required to provide a copy of the most recent year’s
Federal tax return, including all schedules. Collecting tax returns and tax transcripts from
disaster loan applicants not only helps establish repayment ability and approve the loan, but also
serves as one of the SBA’s strongest internal controls to validate eligibility.
As detailed above, SBA has instituted a system of rigorous system controls and validations. But
a requirement of tax returns and tax transcripts is not among them. This is because the CARES
Act, in streamlining the COVID-19 EIDL application process, prohibited SBA from requiring
applicants to submit a tax return or tax transcript. Throughout the Draft Report, and in your
recent testimony on October 1, 2020, before the House Small Business Subcommittee on
Investigations, Oversight and Regulations, OIG describes this move as a “lowering of guardrails”
and incorrectly characterizes this pivotal change as a unilateral action taken by SBA. In truth,
SBA implemented the COVID-19 EIDL program with rigorous system controls and validations,
but it did so in accordance with the statutory requirements set by the CARES Act.
4. Based on its significantly flawed third finding, the Draft Report recommends that SBA
“[r]eview the applicants with approved loans to determine if there are undisbursed funds
remaining that should be suspended until the business start date is verified and the applicant is
deemed eligible based on the CARES Act eligibility requirements. If the applicant is deemed
ineligible, recover any disbursed funds, deobligate any undisbursed funds, and flag the
application as ineligible.” As more fully explained above, SBA strongly disagrees with the
finding associated with this recommendation because there was insufficient evidence that loans
were provided to businesses not eligible based on the CARES Act eligibility requirements.
However, where appropriate, SBA continues to work to expand and strengthen controls for the
COVID-19 EIDL program and partially agrees with the recommendation to explore developing
and implementing additional controls to validate the self-certified business start date.
The Draft Report next recommends that SBA “[r]eview the advance grants to determine if the
application was legitimate and the business met CARES Act eligibility requirements. If not,
recover the funds and flag the application as ineligible.” Again, SBA strongly disagrees with the
findings associated with the recommendation. However, where appropriate, SBA continues to
work to expand and strengthen controls for the COVID-19 EIDL program and partially agrees
56
with the recommendation to review a sampling of EIDL advances to determine if they were not
provided to eligible businesses. In accordance with current protocols, SBA will forward any
EIDL advances determined to be potentially fraudulent to the OIG for further investigation and
place undisbursed loan funds, if any, on Agency Hold.
The Draft Report next recommends that SBA “[r]evise the FY 2021 Improper Payments Act
Checklist to include checking EIN dates for COVID-19 EIDLs and advance grants or program
the system to flag erroneously approved loans and advance grants as improper payments; the
information should be used during the FY 2021 improper payments estimation process.” SBA
does not agree with the recommendation to add EIN dates to the FY 2021 Improper Payments
Act Checklist for the COVID-19 EIDL program because EIN dates are not a conclusive way to
determine the business start date and, to date, have not been made available to SBA for the
purpose of processing COVID-19 EIDL applications. However, SBA will continue to explore
alternative methods for validating the business start date. Furthermore, SBA does not agree with
the recommendation to flag loans as improper based on checklist items added post-disbursement
which were not available at the time the loan was approved and which continue to not be
available to SBA.
Finally, the Draft Report recommends that SBA “[s]trengthen controls for verifying an entity’s
start date to ensure applicants meet eligibility requirements.” SBA partially agrees with this
recommendation and will continue exploring alternative controls for validating the business start
date, and SBA will evaluate the feasibility of adding those controls to application processing and
disbursement. SBA has made several attempts to gain access to EIN dates obtained directly from
the IRS, both before and after the launch of the new streamlined COVID-19 EIDL application.
The SBA OIG gained access to the same EIN dates from its counterparts at IRS, but to date it has
been unwilling to share the information with SBA’s Office of Disaster Assistance, while
simultaneously recommending that SBA add it as a new internal control and retroactively apply
it to the improper payment analysis.
***
SBA takes very seriously its stewardship of taxpayer funds and is committed to mitigating risks
of fraud, waste, and abuse in the programs it administers. As you previously recognized in your
October 16, 2019, testimony before the House Small Business Committee, “[t]o its credit, SBA
has prioritized remediation of control weaknesses. The impact of these efforts includes reducing
the possibility of fraud and waste . . . .” SBA diligently is working to ensure that the EIDL
program provided in response to COVID-19 meets these same high standards.
SBA is proud of its role in providing economic relief to small businesses impacted by COVID-
19. EIDL loans and advances have been a critical part of that relief. As of October 11, 2020,
SBA has approved over 3.6 million EIDL loans for a total of almost $191.6 billion, and over 5.7
million Advances for a total of $20 billion. The performance of SBA staff during these trying
times—providing essential financial support to millions of legitimate small business in need of
assistance—has been nothing short of remarkable.
While SBA is proud of its historic success in delivering EIDL assistance over these past few
months, SBA stands ready to consider suggestions for how it might strengthen internal controls
in its disaster response to the Coronavirus pandemic. But to be productive, such suggestions must
have foundation in fact and must stem from thorough analysis and due diligence that accurately
identifies the scope of the problem to be mitigated. In this regard, it is disappointing that the
57
process leading to the Draft Report did not afford SBA a meaningful opportunity to assist OIG in
its analyses of the source data and loan processes. In past audits, OIG has reviewed preliminary
findings with SBA to better understand the source data and loan processes prior to drafting its
report. Unfortunately, for this audit, OIG did not provide SBA with an opportunity to review the
ongoing audit work. Had such an opportunity been afforded, SBA would have been able to
correct OIG’s misinterpretations of the loan data and loan processes before the audit team
developed its findings and recommendations, and could have helped to ensure that those findings
and recommendations complied with the applicable reporting standards for performance audits
that report on instances of fraud. 35 SBA hopes that in its future audit work, OIG will resume the
cooperative procedures it previously has employed—cooperative procedures that safeguard
taxpayer money by making OIG’s and SBA’s partnership more efficient and more productive.
SBA is not inclined to take valuable resources that are committed to helping small businesses
recover and redirect them towards implementing recommendations that are based on unreliable
audit findings. On the other hand, where recommendations have a basis in reliable audit findings,
SBA will carefully consider and, as appropriate, implement them as it seeks to continuously
improve its delivery of disaster assistance. As more fully explained above, because of the Draft
Report’s critical flaws, none of its recommendations will be implemented as they were framed in
the Draft Report. But SBA can partially agree to most of them, and it will continue to seek ways
to improve its COVID-19 disaster response.
Sincerely,
James Rivera
Associate Administrator, Office of Disaster Assistance
35 See Government Auditing Standards (2018 Rev.) § 9.40 (“Auditors should report a matter as a finding when they
conclude, based on sufficient, appropriate evidence, that fraud either has occurred or is likely to have occurred that is
significant to the audit objectives.” (emphases added)).
58
Appendix I: Technical Comments and Corrections
Executive Summary
1. Paragraph 1: “SBA provides Economic Injury Disaster Loans (EIDLs) of up to $2 million
to eligible entities (e.g. small businesses, nonprofits, farms, etc.).”
a. Response: The EIDL program provides working capital loans of up to $2 million
to small non-farm businesses, small agricultural cooperatives, small businesses
engaged in aquaculture and most private nonprofit organizations of any size. For
COVID-19, eligibility was expanded to agricultural enterprises.
2. Paragraph 5: “To expedite the process, SBA ‘lowered the guardrails’ or relaxed internal
controls, which significantly increased the risk of program fraud.”
a. Response: This is a mischaracterization of how the COVID-19 EIDL program
was implemented. To process COVID-19-related EIDL applications, SBA
launched a new streamlined application that handled loan intake, processing, and
closing for millions of applications. Historically, the disaster loan program’s
strongest internal control is the ability to receive directly from the IRS recent tax
transcripts. The CARES Act removed that control. However, SBA leveraged
technological solutions to add dozens of novel validations and internal controls to
the new streamlined application process.
3. Paragraph 5: “The unprecedented demand for COVID-19 EIDLs and the equally
unprecedented challenges SBA had in responding to this pandemic combined with
lowered controls resulted in billions of dollars in potentially fraudulent loans and loans to
potentially ineligible businesses.”
a. Response: Beyond unprecedented demand, the COVID-19 response also was
unique for many reasons, including: it entailed a national emergency with all 50
states, 6 US territories, and the District of Colombia declared at essentially the
same time; it required a virtual response with no physical disaster recovery
centers or business recovery centers opened to meet in-person with businesses; it
involved a novel grant program, where the preexisting system was set up to
process loans, not grants; and it was the first time in decades that SBA provided
disaster loan assistance to agricultural enterprises. As to the Draft Report’s
assertion of lowered controls, this is a mischaracterization of how the COVID-19
EIDL program was implemented. To process COVID-19-related EIDL
applications, SBA launched a new streamlined application that handled loan
intake, processing, and closing for millions of applications. Historically, the
disaster loan program’s strongest internal control is the ability to receive directly
from the IRS recent tax transcripts. The CARES Act removed that control.
However, SBA leveraged technological solutions to add dozens of novel
validations and internal controls to the new streamlined application process.
4. Paragraph 6: “Based on our analysis of SBA’s COVID-19 EIDL data, as of July 31,
2020, we found SBA approved $14.3 billion ($13.4 billion disbursed) in COVID-19
EIDLs to accounts that differed from the original bank accounts listed on the loan
applications; $62.7 billion ($58.0 billion disbursed) in multiple (between 2 and 245)
COVID-19 EIDLs to applicants using the same IP addresses, email addresses, bank
accounts, or businesses listed at the same addresses; and approximately $1.1 billion in
COVID-19 EIDLs and emergency advance grants to potentially ineligible businesses.”
59
a. As more fully described in SBA’s narrative response, these findings rest on
flawed analyses.
Introduction
5. Page 1, Paragraph 2: “SBA was tasked with lending more than $373 billion in COVID-19
EIDLs and $20 billion in COVID-19 emergency advance grants, which is more disaster
loan funding than all years combined since the agency was created in 1953.”
a. Response: To be more precise, the more than $413 billion in combined EIDL loan
and emergency advance grant funds is nearly 6 times the total amount of disaster
loan funding for all years combined since SBA was created.
6. Page 1, Paragraph 3: “Additional laws passed in response to the COVID-19 pandemic
and discussed in this report expanded the types of organizations that qualify as eligible
entities.”
a. Response: The additional laws referenced in this statement went beyond
expanding eligibility to other types of organizations; they restricted internal
controls and created a new emergency advance grant program.
7. Page 2, Figure 1: “3/25 – SBA’s DLAP portal crashes and data breach; SBA outsources
the application process”
a. Response: This statement is not accurate. The portal was experiencing latency
issues and SBA did take it offline periodically for maintenance and upgrades. One
of the upgrades led to a data “exposure,” not a breach. The new streamlined
application portal was implemented to better handle the high volume of
applications SBA was expecting, along with the launch of a new Advance
program.
8. Page 2, Figure 1: “3/27 – CARES Act provide additional EIDL funding and creates Grant
program”
a. Response: The CARES Act did not provide any additional loan authority for the
EIDL program; it created the Advance program with an initial amount of $10
billion.
9. Page 2, Figure 1: “4/3 – SBA lowers maximum EIDL to $15,000”
a. Response: This should be “temporarily lowers” because the action was reversed 2
days later. Additionally, SBA went back and increased all of the loans that were
subject to the temporary $15,000 loan limit.
Background
10. Page 2, Paragraph 2: “SBA typically determines repayment ability from the business’s
federal tax return and other income and expense information.”
a. Response: The tax returns also serve as a critical internal control to help validate
legitimate businesses, but the ability to require tax returns was removed by the
CARES Act.
11. Page 2, Paragraph 3: “For COVID-19 EIDLs, SBA lowered the maximum amount to
$500,000 on March 16, 2020.”
a. Response: This is not accurate. SBA did not lower the maximum loan amount to
$500,000. This amount was only intended to be Phase 1. The intent was if the
business were eligible for more, SBA would go to Phase 2, which provides up to
60
$2 million, but SBA would have required any real estate owned to be included as
collateral. SBA also would have added a full repayment analysis.
12. Page 2, Paragraph 3: “That same day, SBA also set the minimum credit score at
[REDACTED] for application approval.”
a. Response: SBA requests that this information be redacted. SBA does not disclose
certain underwriting details, such as the credit score used for auto-decline
business rules. Credit score can be used to establish repayment ability, but SBA
can still approve loans for applicants with credit scores below [REDACTED] if
SBA can establish repayment ability through other methods. If the [REDACTED]
credit score were publicized, then potentially qualifying applicants with scores
below [REDACTED] might not apply for assistance.
Unprecedented COVID-19 EIDL Application Volumes
13. Page 3, Paragraph 3: “SBA has now approved and distributed more loans for COVID-19
relief than for all other disasters combined in the agency’s history.”
a. Response: To be more accurate, SBA has now approved and disbursed more than
3 times the funds for COVID-19 relief than for all other disasters combined in the
agency’s history.
14. Page 3, Paragraph 4: “To further reemphasize the unprecedented volume, SBA approved
the following multibillion-dollar loan volumes in recent disasters.”
a. Response: It should be noted that for Hurricanes Katrina, Rita, and Wilma, and
for Superstorm Sandy, it took 90 days to approve the first $1 billion, and for
Hurricanes Harvey, Irma, and Maria, it took 45 days to approve the first $1
billion. At the peak of the COVID-19 response, SBA approved approximately $2
billion per day.
Loan Portal
15. Page 4, Table 2, Column 3, Row 1: “Federal Tax Returns – Not Required”
a. Response: This was a direct result of the IRS refusing to provide the transcripts to
SBA, and later the exclusion of tax returns in the CARES Act.
16. Page 4, Table 2, Column 2, Row 6: “Delinquent Federal Debt – Automatic Disapproval”
a. Response: This is not accurate. SBA’s standard policy is not an automatic
disapproval. The statute as well as SBA’s SOP allow for Disaster Loans to be
approved with outstanding Federal Debt.
17. Page 4, Table 2, Column 1, Row 10: “Furniture and Fixtures Collateral”
a. Response: SBA’s UCC filing covers much more than just furniture and fixtures.
Volume Leads SBA to Outsource the Receiving and Processing of Applications to an
Existing Contractor
18. Page 5, Paragraph 2: “SBA turned to a contractor that had been hired on December 7,
2018, to analyze data and underwrite loans.”
a. Response: More accurately stated, the contractor was hired to help streamline
application processing through data analysis and loan underwriting.
19. Page 5, Paragraph 2: “The contractor’s work was delayed by a bid protest but the
Government Accountability Office denied the protest on March 25, 2019.”
61
a. Response: To be more complete, this passage should include that GAO also
approved the contract to proceed.
20. Page 5, Paragraph 2: “The contractor had done only limited work on disaster loans before
the COVID-19 pandemic.”
a. Response: The contractor is a certified participant in SBA’s 8(a) Business
Development Program, which is designed to level the playing field in government
contracting for small businesses that are majority-owned and controlled by
economically and socially disadvantaged U.S. citizens. The contractor was
awarded the SBA contract through a small business set-aside. Like many small
businesses competing for government contracts, the contractor teamed with a
large subcontractor to compete for the SBA contract. Teaming arrangements,
which are authorized by Federal Acquisition Regulations, help small businesses
enhance their experience, capability, and capacity. In a competitive procurement
process involving several small businesses, the contractor received excellent
ratings for its technical approach, IT security, and past performance. The
contractor’s price also was deemed fair and reasonable. Because the contractor—
of all the small businesses competing for the contract—was determined to offer
the best value to the government, SBA awarded it the contract in December 2018.
Later, when SBA experienced an unprecedented surge in EIDL loan and grant
applications in connection with the COVID-19 pandemic, SBA expanded the
contract. SBA has received millions of COVID-19-related EIDL loan and
Advance applications. In a single day—March 31, 2020—SBA received more
than 680,000 applications. The processing of COVID-19-related EIDL loan and
Advance applications would have been delayed significantly had SBA
undertaken a new competitive procurement process to solicit new offers from new
contractors to provide the same type of data analysis and loan recommendations
for the COVID-19-related loans and grants that the contractor already was
providing for SBA’s traditional Disaster Loan Program. Therefore, SBA
determined that expanding the existing contract would provide the most efficient
and effective solution to process the millions of COVID-19-related EIDL loan
and advance applications. Because the contractor was an established SBA
contractor, it was positioned to ramp up and quickly process the influx of
applications. SBA followed established contracting procedures and complied
with all applicable statutes and regulations to modify the contract. With the
contractor’s assistance, SBA has approved and disbursed over 3.6 million EIDL
loans for a total of $191.6 billion, and over 5.7 million Advances for a total of $20
billion. In the span of 71 days, SBA, working with the contractor, approved more
loans—in terms of dollar amount—than SBA previously approved in its entire
history for all other declared disasters combined. The contractor helped SBA
process and approve in one day nearly as much loan value as SBA typically
processes in a year. The contractor also launched a new intake portal, allowing
SBA to process EIDL advances only two days after the emergency grants were
created by the CARES Act.
21. Page 5, Paragraph 4: “However, subcontractor Number 1’s system was not suited well to
process business loans like COVID-19 EIDLs, so it delegated the loan processing and
advance grant tasks to its sister company, also a subcontractor.”
62
a. Response: This is not accurate. The subcontractor was not delegated the
responsibility as a result of the contract modification. The subcontractor was part
of the original contract request to provide loan recommendation and data analysis.
The subcontractor also provided the back-end data integrations for the COVID-19
loans.
22. Page 5, Paragraph 5: “Subcontractor Number 2 took over the reviewing process of
COVID-19 EIDL applications, recommending either approval or denial of each
application.”
a. Response: This should be more accurately worded to describe that the contractor
built a portal and loan decisioning engine based on underwriting guidelines and
businesses rules provide by SBA to make system generated loan
recommendations for SBA loan officers to review.
23. Page 5, Paragraph 6: “SBA rerouted Disaster Loan Application Portal 2.0 so applications
would go directly to subcontractor Number 2, which started receiving the applications on
March 29, 2020, and began processing loans on April 6, 2020.”
a. Response: This omits that a new webform was approved by OMB and a
streamlined application portal was launched. It was not a simple rerouting of
DLAP 2.0.
24. Page 5, Paragraph 7: “Figure 2 shows the number of applications processed by the
subcontractor by day between March 29, 2020, and July 31, 2020.”
a. Response: This is not what figure 2 shows—it shows the number of applications
received, not the number of applications processed.
25. Page 6, Note accompanying Figure 2: “Note: Disaster Loan Application Portal 2.0 was
closed between April 15, 2020 and May 3, 2020, to all eligible entities. SBA reopened
the portal between May 4, 2020 and June 14, 2020, to agricultural enterprises and
reopened to all eligible entities on June 15, 2020 (See p. 11). The openings and closings
of the portal represent the low application volume on certain days.”
a. Response: This is misleading by suggesting that SBA closed the portal without
sufficient reason. In truth, SBA closed the portal upon a lapse in funding, and
SBA re-opened the portal after Congress appropriated additional funds.
26. Page 6, Paragraph 2: “On March 25, 2020, SBA lowered the required credit score for
application approval from [REDACTED] to [REDACTED]. An SBA official said the
change was due to ‘policy decisions’ but did not give any further explanation.”
a. Response: All that SBA did was within its discretion and designed to make the
available funds go as far as possible and serve as many businesses as possible
while also ensuring repayment ability and protecting taxpayer dollars.
b. Response: In addition, SBA requests that the credit score information be redacted.
SBA does not disclose certain underwriting details, such as the credit score used
for auto-decline business rules. Credit score can be used to establish repayment
ability, but SBA can still approve loans for applicants with credit scores below
[REDACTED] if SBA can establish repayment ability through other methods. If
the [REDACTED] credit score were publicized, then potentially qualifying
applicants with scores below [REDACTED] might not apply for assistance.
Additional Criteria Changes – Coronavirus Aid, Relief, and Economic Security Act
63
27. Page 6, Paragraph 3: “Most notably, the Act alleviated the requirements for tax returns
and the credit elsewhere test. These changes allowed SBA to approve an eligible
applicant based solely on its credit score.”
a. Response: The CARES Act states that SBA may either (1) approve an applicant
based solely on credit score and shall not require a tax return; or (2) use an
alternative method to determine repayment ability. So, when approving the loan
based on credit score alone, SBA cannot require a tax return. This passage also
omits to mention that loan approval also was based on a self-certification of the
business start date, activity, annual gross revenues, and cost of goods sold, among
other things. Additionally, CFR Title 13, section 123.6 allows for approval based
on a credit score. This has been in the CFR since April 25, 2014.
28. Page 7, Table 3, Column 1, Row 10: Furniture and Fixtures Collateral
a. Response: The UCC Filings/Security Agreement is much more extensive than
Furniture and Fixtures.
29. Page 7, Paragraph 1: “The CARES Act also expanded COVID-19 EIDL eligible entities
to include businesses, cooperatives, Employee Owned Stock Ownership Plans, and tribal
concerns with not more than 500 employees; sole proprietorships with or without
employees; and independent contractors affected by COVID-19.”
a. As worded, this is inaccurate, as some of these entities already were eligible.
30. Page 7, Paragraph 2: “The CARES Act designated $10 billion for COVID-19 emergency
grants.”
a. Response: It is important to note that the CARES Act created the EIDL Advance
program, which resulted in a surge of new loan applications because businesses
were required apply for the loan in order to receive the Advance, but the Act did
not provide additional loan subsidy for the EIDL loans. Ultimately, there was a
lapse in funding and the application portal was taken offline as result.
31. Page 7, Paragraph 2: “The Act allows eligible entities to request an advance of up to
$10,000 and requires SBA to pay out the funds within 3 days of receiving an
application.”
a. Response: This is not accurate. The Act states that the applicant “may request”
that SBA pay the Advance within 3 days. It does not require that SBA pay the
Advance within 3 days.
32. Page 8, Paragraph 1: “SBA decided that ‘up to $10,000’ meant that each applicant would
receive $1,000 per employee up to 10 employees.”
a. Response: All EIDL advances were subject to this policy. The $1,000 per
employee calculation was in place from the start, not a mid-course change.
Moreover, SBA did not simply “decide” this with no justification, as this passage
implies. Rather, SBA acted within its discretion to make the available funds go as
far as possible and serve as many businesses as possible.
b. Response: In addition, this statement misquotes the CARES Act. The CARES Act
states that the advance amount provided “shall be not more than $10,000.” It does
not require all advances paid to be for the maximum amount of $10,000.
SBA and Subcontractor’s Processes for Recommending Approval or Decline of COVID-19
EIDLs
64
33. Page 8, Paragraphs 2, 3, and 4: “It is important to note that subcontractor Number 2’s
system electronically checks the application; each application is not reviewed by the
subcontractor’s personnel. Subcontractor Number 2’s system uses public domain
information and certain fraud indicators in accessing and verifying loan application
information. The subcontractor’s system verification check of the bank accounts is
contingent on each bank’s Customer Identification Program and the amount of customer
information collected as required under 31 C.F.R. § 1020.220. The subcontractor
estimates that 40 percent of banks do not collect enough information for its system to
verify a bank account. We were told the system makes these checks before the credit
check to determine loan eligibility based on application information. The main reasons
the system would deem an application ineligible are insufficient economic injury,
ineligible business type, or ineligible answers to other application questions, such as
felony convictions, etc.”
a. Response: It is important to note that SBA provides the business rules used in the
loan recommendations. In addition, below is a chart describing possible reasons
for decline, disqualification, or potential fraud. This chart shows the multitude of
processes that exist within the subcontractor’s system and the various checks
done. The Draft Report fails to provide the actual dollar amount associated with
the successes in this process. These numbers represent over $258 billion in
negative decisions based on the subcontractor’s/ODA’s systematic requirements:
Category Sub-Category Units MaxLoanPotential
1. Duplicate NULL 4,027,887 $ 151,284,277,300
2. Declined/Unqualified Suspicious online behavior 301,964 $ 13,267,078,200
2. Declined/Unqualified Fraud Alert on Credit Report 171,001 $ 4,203,019,400
2. Declined/Unqualified Applicant information failed validation 169,842 $ 5,041,085,900
2. Declined/Unqualified Failed online identity verification 81,157 $ 2,345,217,300
2. Declined/Unqualified Loan Officer declined for fraud 33,266 $ 1,024,766,600
2. Declined/Unqualified Applicant has large number of applications with 19,769 $ 524,179,100
other providers
2. Declined/Unqualified High risk IP address 14,571 $ 550,738,100
2. Declined/Unqualified Applicant device(s) associated with fraud 5,059 $ 171,792,300
2. Declined/Unqualified Applicant location is international 4,458 $ 146,532,900
2. Declined/Unqualified Other Validation Issues 1,839 $ 89,065,800
2. Declined/Unqualified Business Started after Disaster Date 162,381 $ 1,057,319,900
2. Declined/Unqualified Prohibited Business Type 119,148 $ 4,061,353,300
2. Declined/Unqualified Convicted Of A Criminal Offense In Past Year 5,258 $ 131,071,600
2. Declined/Unqualified Business Suspended From Government 2,034 $ 54,620,700
2. Declined/Unqualified Insufficient Gross Economic Injury 1,483,480 $ 68,055,600
2. Declined/Unqualified Credit Score <threshold 1,983,495 $ 51,869,370,700
2. Declined/Unqualified Declined at Loan Officer Discretion 526,922 $ 18,035,168,233
3. On Hold a. Not Disbursed 33,590 $ 1,673,599,350
3. On Hold b. Disbursed 32,091 $ 1,790,324,489
3. On Hold c. Returned 15,284 $ 753,384,700
In addition, ODA and the subcontractor consistently have made systematic
enhancements in response to internal and external comments. ODA continues to
listen to all partners to ensure good stewardship of taxpayer dollars. These
enhancements include:
65
Date Enhancement(s)
March 29 EIDL COVID-19 Application Intake Form Launched
April 6 Applicant Portal & Loan/Advance Decisioning Platform Launched
April 24 Assigned Task Username Display; Fully Rendered Credit Report; Additional
Permissions for Batch Approval; User Creation Enhancements; Display Bank
Info Validation Errors to Users; Loan Resizing; Additional Phone and Email
Validations; Letter Enhancements; Ownership Percentage Validations
April 30 Accept Agricultural Entity Applications; Advance Express Grant Machine;
Post Loan Approval Advance Funding; Enhanced LO Display of Unvalidated
Bank Info
May 6 Create Obligating and Funding Error Tasks; Contact Info Data Processing
Enhancements; Enhanced Field Validations; Decline Letter & Email
Enhancements; Update to EI Formula; Increase Server Capacity; Add
Account Ownership to CBR
May 19 Intake Form Additional Field Validations; Application Search Filtering
Enhancements; Pass Non-Profit Flag to ETRAN; Routing Number Validation
on Intake Form, Client Portal & ETRAN; Enhanced SSN Validation; ZIP
Code to State Validation; System Performance Enhancements; Signatory
Enhancements; Client Portal Help Enhancements
June 3 Email Reminders for Inactivity; Advance Reconsideration Portal; Additional
Data Modification Restrictions based on Stage and Role; Display Funded
Status; Create Funding Hold Checkbox; Interest Rate Validation for Entity
Type Changes; System Text Updates
June 18 Auto-Disposition Inactive Applications; Add Loan Disclosure Language;
Task Search Capability; LA&A Updates, Allow Funding Hold at Any Stage;
Default Check Advance Request Box; Client Portal Text & Display Changes
July 9 Advance Recon for Non-Request Applicants; ETRAN Interaction and Notes
Enhancements; Invalid Email Error Handling; Enhanced Bank RTN
Validation; Loan & Advance Amount Exceptions with Permission
Limitations; Tax ID/Entity Type mismatch logic and LO Messaging; Client
Portal Text Modifications
July 30 Intake Form Modifications; Intake Form Field Validation Enhancements;
Advance Decision History; Notes for Historic ETRAN Errors; Automated
ETRAN Error Daily Monitoring; Bulk Document Upload with Notes;
Enhances Email Syntax Validations
August 14 Task for Unsigned Closing Docs; Advance Decision History in Notes;
Decision Engine Label Text Changes; Bank info History Table; Tracking and
Notes for Application Hold Actions; Additions to Decline Reasons
September 2 Intake App Lookup Screen; Text Edits for Loans >$200K; Enable Funding
Hold at Any Stage
September 15 Loan Reconsideration Process Phase 1; Update Decline Letter Functionality
October 8 Multifactor Authentication Enhancements; Servicing Office Update; Loan
Reconsideration Process Phase 2
66
34. Page 9, Paragraphs 2 and 3: “Both were encouraged to reapply using the Disaster Loan
Application Portal 2.0. If those applicants did not reapply, they did not receive an
advance grant. SBA required reapplication to ensure the applications went directly to
subcontractor Number 2’s processing system. SBA’s message told the applicant that the
new application would be used for both the COVID-19 EIDL and the advance grant.
SBA also mailed notices to the applicants to notify them of the requirement to reapply.
Unlike the mail-in applications (hard copy applications), SBA officials said they
maintained these applicants’ places in line according to the receipt date of their previous
unprocessed digital application.”
a. Response: This passage fails to account for why SBA established this process and
neglects to acknowledge that applicants who did not apply after enactment of the
CARES Act on the new streamlined application portal did not provide the
required information and self-certifications required to consider them for the
advance. The CARES Act established the EIDL advance (grant) program, but to
receive an advance, the applicant first had to request one. The EIDL applications
being used before the advance program was launched did not include an option
for the business to request the advance. The original application also did not
require the business to provide the number of employees, which was used to
calculate the amount of the advance. The original application did not collect from
the applicant the bank account and routing number to deposit the advance funds.
All of that had to be added to the new streamlined application, in addition to the
validations and internal controls used to qualify applicants for a new application.
April Policy Changes to Extend COVID Injury Loan Funds
35. Page 10, Paragraph 1: “However, a week later on April 11, 2020, SBA restored the
maximum amount of a COVID-19 EIDL to $500,000 and the minimum required credit
score back to the original [REDACTED]. According to an SBA official, the changes
were ‘policy decisions.’ The official did not give any additional explanation.”
a. Response: SBA reiterates its request that the credit score information be redacted,
for reasons already discussed.
b. Response: Also, this paragraph is incorrect. The $15,000 loan limit was temporary
and was raised two days later. Furthermore, SBA increased all loans that were
subject to the temporary $15,000 limit. Also, there was no initial $500,000 loan
limit; that was just the Phase 1 calculation. The $500,000 referenced by this
paragraph is not a true loan limit in the way that the $150,000 has been applied,
because applicants could get more than $500,000 using the Phase 2 calculation.
c. Response: Finally, the reason that an SBA official said the changes were “policy
decisions” was because OIG was inquiring into privileged information.
36. Page 10, Paragraph 5: “On April 15, 2020, SBA closed the Disaster Loan Application
Portal 2.0 to new applications again.”
a. Response: The statement is incorrect because this was the first occurrence of the
2.0 portal being closed to new applications. The word “again” implies that it was
taken offline before April 15, 2020, which it was not.
Paycheck Protection Program and Health Care Enhancement Act
67
37. Page 10, Paragraph 6: “On May 3, 2020, SBA made the decision to cut the COVID-19
EIDL maximum from $500,000 to $150,000.”
a. Response: Again, the $500,000 was never a true loan limit, it was only the limit
for a Phase 1 calculation.
Funding Still Available as of July 31, 2020
38. Page 11, note b accompanying Table 4: “This includes 298 loans (117 Cancelled and 181
Active Undisbursed) that we could not tie back to an application in the subcontractor
Number 2’s system, SBA’s application system, or the SBA data warehouse.”
a. Response: Bank details are provided only on disbursement, not when a loan is
approved. OIG provided ODA with a list of 298 loans that do not have bank
accounts in the ETRAN system. OIG appears to be unfamiliar with the process of
disbursing. Of the 298 loans referenced, 117 were cancelled and never disbursed,
and 181 are awaiting additional documentation and have not yet been disbursed.
None of the 298 loans have been disbursed, which means they would not have
bank information exported to ETRAN. Once again, there is no risk with any of the
298 loans referenced by OIG.
Timing of COVID-19 EIDLs and Advance Grants
39. Page 11, Paragraph 1: “SBA took an average of 49 days to receive, underwrite, and fund
loan applications for 2,783,852 COVID-19 EIDLs disbursed as of July 31, 2020. In some
cases, the process took up to 124 days to fund loan applications, but some were funded on
the same day the application was received (see Figure 4).”
a. Response: This is a misleading summarization of loan processing times. Less than
100 loans took 124 days to fund, but over 60,000 were funded on the same day,
over 110,000 took just one day, and nearly 80,000 were funded in just two days.
In addition, this summarization fails to provide context for certain longer
processing times—including, for example, closure of the portal due to lack of
appropriation and instances when SBA was waiting on borrowers to complete
their applications.
40. Page 12, Paragraph 2: “From the beginning of the program through July 31, 2020, SBA
took between 0 days (same day) and 106 days (average of 22 days) to pay out advance
grant funds (See Figure 5). The Act required that grants be disbursed within 3 days.”
a. Response: This is not accurate. The Act provides only that the loan applicant
“may request” that SBA provide the Advance within 3 days; it does not “require”
that such a request be granted. The Draft Report should provide an accurate
interpretation of the Act.
41. Page 12, Paragraph 3: “For example, 446,700 advance grants were funded 24 days after
the application was received.”
a. Response: Again, the Draft Response is providing misleading information by
omitting shorter response times. For example, over 400,000 advances were
funded in one day and over a different 3-day span SBA disbursed 933,000
advances.
Staffing
42. Page 15, Figure 8: “Longest Wait Times by SBA’s Customer Service Center”
68
a. Response: SBA provided to OIG the data for longest and shortest call wait times,
but the Draft Report uses one caller per day to represent longest possible wait
time, which misrepresents the overall wait times.
Hotline Complaints
43. Page 15, Paragraph 2: “In the Management Alert issued in July 2020, we reported that
OIG had received more than 1,000 complaints. By August 31, 2020, OIG had received
approximately 42,000 hotline complaints about SBA’s initial response to COVID-19,
which is significantly higher than the approximately 900 hotline complaints we received
the previous year. We are in the process of evaluating all of the complaints.”
a. Response: If the Draft Report is comparing FY19 to FY20, it should include the
total number of disaster loan applications processed for context. In FY19, SBA
processed 95,626 applications and OIG received 900 hotline complaints (0.9%).
In FY20, SBA has processed 14 million COVID-19 applications and OIG has
received 42k hotline complaints (0.3%). Hotline complaints are down
significantly in terms of percentage of total applications processed. In addition,
the Draft Report implies that complaints suggest a material issue, but it does not
reveal the substance of the complaints and has refused to make the complaints
available to SBA. The Draft Report declines to acknowledge that complaints can
be unfounded or otherwise not raise a material issue, and that the filing of a
complaint—by itself—reveals nothing.
b. Response: The Draft Report states that OIG has received 42 times the volume of
hotline complaints compared to the previous year, but SBA has received 400
times the application activity.
Results
44. Page 15, Paragraph 3: “However, the unprecedented demand for COVID-19 EIDLs and
equally unprecedented challenges SBA had in responding resulted in billions of dollars
being distributed to ineligible entities or fraudsters.”
a. Response: The Draft Report, even on its own terms, provides no support for this
assertion. At most, the Draft Report’s unreliable findings may suggest that
“disaster loan funds could have been disbursed to potentially ineligible entities.”
45. Page 16, Bullets 1-3
a. Response: There are many legitimate reasons why an eligible borrower would
need/want to change their bank account for disbursement. It does not
automatically mean they are potentially fraudulent disbursements.
b. Response: There are many legitimate reasons why multiple applications are
submitted through the same IP address, e.g. law firms and accountants filing on
behalf of their clients.
c. Response: No explanation provided for bullet #3 for why the Draft Report
approximates these loans that went to potentially ineligible businesses.
Finding 1
46. Page 17, Paragraph 2: “We found 281,414 differences between the bank account number
on the application and the number recorded in Capital Access Financial System. In some
cases, the applicant made mistakes when completing the application.”
69
a. Response: This number does not distinguish between differences due to apparent
mistakes and those due to other reasons. The examples provided are of only 22
and 3 loans.
47. Page 17, Paragraph 4: “However, other scenarios we found are highly suspicious and
strong indicators of potential fraud. Suspicious examples include bank account numbers
being significantly different or routing numbers of entirely different banks than the
account numbers on the original application. It is also suspicious when the change is to an
online-only debit card financial institution instead of a checking account at the brick-and-
mortar banking institution listed on the original application.”
a. As more fully detailed in SBA’s narrative response, this assertion fails to
acknowledge innocent explanations.
Finding 2
48. Page 19, first paragraph: “We found that as of July 31, 2020, SBA had approved more
than one loan to applicants that used the same IP addresses, email addresses, business
addresses, or bank accounts. Although there may be some legitimate reasons for
individual occurrences, multiple occurrences indicate a strong probability of fraud.
Specifically, SBA: approved 977,086 potentially fraudulent COVID-19 EIDLs totaling
$62.7 billion, of which $58 billion had been disbursed, to applicants using the same IP
addresses (an additional $614.8 million was disbursed in advance grants); approved
319,936 potentially fraudulent COVID-19 EIDLs for $26.7 billion, of which $25.4 billion
has been disbursed, to applicants using the same email addresses (an additional $172.2
million was disbursed in advance grants); approved 260,109 potentially fraudulent
COVID-19 EIDLs totaling $15.4 billion, of which $14.5 billion had been disbursed, to
businesses listed at the same address (street, city, and the zone improvement plan, or ZIP
code) on their applications (an additional $134.9 million was disbursed in advance
grants); and approved 16,015 potentially fraudulent COVID-19 EIDLs for $928.1
million, of which $811.5 million had been disbursed, to the same bank accounts (an
additional $2.5 million was disbursed in advance grants).”
a. Response: As more fully explained in SBA’s narrative response, SBA’s analyses
of the source data for the top ten examples that the Draft Report gives to support
each of these findings show that the examples involve legitimate loan activity,
and that the Draft Report has overlooked the entirely legitimate reasons why
applicants used duplicate information. SBA’s analyses, therefore, call these
figures into serious question.
Multiple Loans to Applicants Using the Same IP Addresses
49. Page 21, Paragraphs 1 – 4: [Listing various examples of IP addresses from which
multiple applications were sent]
a. Response: While SBA cannot fully respond to specific examples without the
underlying source data, it appears that the auditors have not validated their own
information, as the Draft Report employs cautious language, such as “what looks
like an email address at a fish market.” But generally speaking, as more fully
detailed in SBA’s narrative response and its analysis of the Draft Report’s top ten
examples, use of the same IP address, by itself, is not a reason to suspect fraud.
70
Multiple Loans to Applicants Using the Same Email Addresses
50. Page 22, Paragraphs 3 – 4: [Listing various examples of e-mail addresses from which
multiple applications were sent]
a. Response: While SBA cannot fully respond to specific examples without the
underlying source data, generally speaking, and as more fully detailed in SBA’s
narrative response and its analysis of the Draft Report’s top ten examples, a
similar e-mail address, by itself, is not a reason to suspect fraud.
Multiple Loans to the Businesses with the Same Address on the Loan Application
51. Page 23, Paragraphs 2 – 4: [Listing various examples of loans to businesses with the
same address on the loan application]
a. Response: While SBA cannot fully respond to specific examples without the
underlying source data, generally speaking, and as more fully detailed in SBA’s
narrative response and its analysis of the Draft Report’s top ten examples, a
similar address, by itself, is not a reason to suspect fraud.
Multiple Loans to the Same Bank Accounts
52. Page 24, Paragraph 1: “For example, 13 different types of businesses (financial,
automotive, gymnastics, etc.) received loans for $1,167,800 to the same bank account. It
is possible these are legitimate different types of business run out of one bank account.
However, it is suspicious behavior and should be researched by SBA to determine if
these are legitimate businesses.”
a. Response: While SBA cannot fully respond to specific examples without the
underlying source data, generally speaking, and as more fully detailed in SBA’s
narrative response and its analysis of the Draft Report’s top ten examples, use of
the same bank account, by itself, is not a reason to suspect fraud.
53. Page 24, Paragraphs 4 – 6: [SBA Abandoned the Rule of Two]
a. Response: As more fully detailed in SBA’s narrative response, this is not an
accurate characterization of the robust, two-tiered review process that SBA
employed.
54. Page 25, Paragraph 1: “Further, SBA employees could potentially see trends in fraudulent
applications that a system potentially could not identify.”
a. Response: The Draft Report provides no support for the counterintuitive notion
that individuals manually examining individual applications can spot trends that
an algorithm cannot.
55. Page 25, Paragraphs 2 – 3: [Timing Goals for Loan Decisions]
a. Response: These paragraphs fail to recognize that manual review occurred only
after an automated review that employed robust internal controls and validations.
56. Page 26, Paragraphs 3 – 7: [SBA Action to Address our July 2020 Management Alert on
Duplicate Loans]
a. Response: The Draft Report neglects to acknowledge that SBA already was
taking actions to address the issue. On June 18, SBA’s contractor put into place
various additional controls, including a “hold” feature, related to fraud prevention.
Moreover, a subsequent July 9 build put in place additional bank validation
checks. These builds were in place prior to the management alert. In any event,
71
the later actions that SBA took in response to the management alert are an
example of the successful, cooperative partnership between SBA and OIG.
Finding 3
57. Page 29, Paragraph 2: “The CARES Act requires that applicants had to be in business on
January 31, 2020, to be eligible for COVID-19 EIDLs or advance grants. To determine if
applicants were in business on January 31, 2020, we cross-referenced a database of
Employer Identification Number (EIN) registrations made between February 1,2020, and
July 31, 2020, and matched them to data in SBA’s subcontractor Number 2’s database as
of August 5, 2020. We removed all sole proprietorships.”
a. Response: As more fully explained in SBA’s narrative response, this analysis
rests on a false equivalence between registration of an EIN and being in business.
58. Page 29, Paragraph 6: “During this inspection, we also found that ineligible entities (such
as “adult industry” businesses) received COVID-19 EIDLs. In addition, SBA received
fraudulent applications for prominent national leaders that were obviously not legitimate
applications and in one case paid the $5,000 advance grant before denying the loan.”
a. Response: The Draft Report should be more specific regarding “adult industry.”
In any event, without the underlying source data, SBA is unable to respond to
these examples.
59. Page 29, Paragraph 7: “We also have received hotline complaints about identities being
stolen and used for fraudulent applications. For example, SBA received fraudulent loan
applications in the name of a prominent real estate developer, a major shoe manufacturer,
and one of its own SBA District Office Directors. SBA appropriately denied the loan for
the real estate developer. However, SBA approved and funded the fraudulent loan for the
shoe manufacturer in the amount of $150,000. It also approved the loan for its District
Director but caught the mistake before the loan was disbursed.”
a. Response: The examples in which loans were denied or not disbursed show that
SBA’s process is working. As to the shoe manufacturer example, SBA is unable
to respond without the source data.
72
File and source
- File
- sba-oig-report-21-02-508-1-pdf_ca396d7a5b34246b.pdf
- Size
- 1,942,539 bytes
- SHA-256
- 6125f568537fac2105c12078a85da00ce325cae6e44714564d932d1a100fa72b
- Original
- www.sba.gov