On April 28, 2020, Treasury Secretary Mnuchin announced that companies that received loans of more than $2 million through the Paycheck Protection Program (“PPP”) of the CARES Act will be closely scrutinized. Mr. Mnuchin’s announcement followed public outcry after reports surfaced that large, and even publicly-traded, companies received loans through the PPP, which can be forgiven if used for payroll and certain other expenses, such as commercial rent and utilities. Mr. Mnuchin stated that any loan greater than $2 million would be subjected to a full review before being forgiven and that the Small Business Administration (“SBA”), the agency backing the loans, would audit the business to determine whether the certifications submitted in connection with the loan were truthful and accurate. The SBA and the Department of Treasury (“DOT”) later clarified Mr. Mnuchin’s comments in their updated FAQs (link to PDF), writing that the loans would be reviewed once the borrower submitted its loan forgiveness application, they would also review loans for less than $2 million “as appropriate,” and that additional guidance on the review “will be forthcoming.” If the certifications were found to be false, Mr. Mnuchin threatened that the companies that made the certifications could face criminal consequences.
Against this backdrop, any company that received a loan through the PPP should be prepared to handle government requests for information as a potentially adversarial inquiry. Businesses should also consider whether their need for the funds is worth the risk of a potential investigation (which could be lengthy, given the 10-year federal statute of limitations for fraud affecting a financial institution), including legal costs and reputational harm.
Small Business Loan Requirements and Certifications
To be eligible for the PPP, applicants must meet certain size restrictions and be a “small business concern” under the SBA’s employee-based, revenue-based or alternative size standards, or meet the CARES Act Employee Headcount Standard, which is generally not more than 500 employees.[1] For this purpose, “employees” (or revenues or other financial metrics) include those of affiliates. Business entities are considered affiliates when they control, are controlled by or are jointly controlled by a third party(ies), regardless of whether that control is, or has ever been, exercised. Affiliates include domestic and foreign affiliates, regardless of whether the affiliates are for-profit ventures. Affiliation is defined broadly and can arise under a number of circumstances, such as majority ownership, minority ownership with negative control (i.e., veto rights), management agreements, and identity of interest.
When submitting an SBA loan application, the applicant must certify as true its loan eligibility based on the applicable size restrictions and the SBA guidance has clarified that it is the borrower’s responsibility to get this right. In addition, PPP loan applicants must certify in good faith that their loan request is necessary, specifically that “current economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.” While the CARES Act eliminates the prerequisite loan requirement that a small business is “unable to obtain credit elsewhere,” the SBA clarified in a number of separate guidance releases issued April 23-27, 2020, that applicants need to assess "their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business." While it is not entirely clear what lower level of liquidity would cause a significant risk of a detrimental business outcome, the April 23 guidance did make clear that “it is unlikely that a public company with substantial market value and access to capital markets will be able to make the required certification in good faith.”
Audits by the Federal Government
The CARES Act provides the federal government multiple avenues to audit borrowers under the PPP. Section 1408 of the Act created the position of Special Inspector General for Pandemic Recovery (“SIGPR”) and Section 15010 created the Pandemic Response Accountability Committee (“PRAC”) (together the “Supervisory Entities”). The Supervisory Entities are responsible for preventing and detecting any fraud, waste, and abuse in connection with the loans made under the CARES Act. They each have the power to subpoena companies for documents relevant to their inquiry as well as to interview or ask for written affidavits under oath from individuals who they believe have relevant information. PRAC and the SIGPR will likely work together, as PRAC has a mandate to support all Inspectors General, including the SIGPR, in their oversight of the disbursed funds. Moreover, the United States Government Accountability Office (“GAO”)—a highly experienced government agency that provides auditing, evaluation, and investigative services for Congress, commonly referred to as the “congressional watchdog”— is set to join the other Supervisory Entities to forcefully investigate CARES Act related fraud, waste and abuse.
There is precedent for statutorily-created oversight bodies auditing recipients of government bailouts. In 2008, Congress created the Special Inspector General for the Troubled Asset Relief Program (“SIGTARP”) to oversee companies and financial institutions that received money under TARP and to prevent fraud and abuse of taxpayer money. The audits often had specific objectives, such as determining how TARP funds were spent. Here, the Supervisory Entities will be tasked with auditing PPP recipients to ensure that the business that applied for the loan met the requirements for loan eligibility and that they meet the conditions for loan forgiveness. Of course, these reviews will be done with a hindsight bias that may not adequately take account of the uncertainties faced by the recipient at the time of application.
The audits will examine factors such as: (i) the size of the business, (ii) whether the business had an actual need for the funds, (iii) whether the funds were properly spent on the business expenses specified in Section 1109 of the CARES Act, (iv) whether the loans were used for forgivable purposes, and (v) whether employee and compensation levels were maintained as per the conditions for loan forgiveness. To meet this objective, the Supervisory Entities will conduct a detailed review of all relevant information. This may include documents that detail the financial strength of the business, whether the business could have pursued other avenues to raise funds, and how the funds were spent. The Supervisory Entities will also likely review internal communications that reflect the process through which the business determined it met the qualifications, and should apply, for the loan, as well as any other documents which may reveal whether the business needed the loan to avoid a detrimental business consequence. The Supervisory Entities will also likely interview employees (including executives) involved in the process to better understand the factors the company considered in deciding it was eligible for the loan and the ultimate decision to submit an application. Importantly, the Supervisory Entities may further interview and request documents from entities that are not part of the business being audited, but maintain potentially relevant information, such as accounting firms and financial institutions that have information regarding whether the business met the eligibility requirements for the loan under Section 1102 of the CARES Act. The Supervisory Entities have the authority to enlist any public agency or private person to assist them in conducting the audits.
Criminal Liability that Could Follow a Company Audit
In addition to its audit authority, both the SIGPR and PRAC maintain investigative powers. If an audit produces evidence of criminal conduct, the Supervisory Entities may work in conjunction with other federal agencies to fully investigate such conduct. There are multiple types of criminal liability that companies may face for fraudulent conduct in connection with the CARES Act, including mail fraud, wire fraud, and bank fraud, in addition to statutes that criminalize the making of false statements to the United States government.[2] Significantly, the federal statute of limitations for frauds affecting financial institutions – which would cover most if not all of the crimes that could be charged in this context – is ten years. As further described below, all of these statutes include a knowledge requirement as well as an intent element.
There are multiple federal statutes that penalize the making of false statements to federal officials and financial institutions, in loan applications.[3] Section 1109 of the CARES Act states specifically that a borrower is subject to criminal liability pursuant to 15 U.S.C. § 645, which prohibits false statements “for the purpose” of obtaining a loan under the Small Business Act (§ 645(a)). The statute requires both knowledge that the statement is false as well as the intent to use the false statement to obtain the loan. Other SBA specific crimes that may be prosecuted in connection with fraud arising under or in connection with a PPP loan include Embezzlement (15 U.S.C. § 645(b)) and Concealment (15 U.S.C. § 645(c)).
Likewise, 18 U.S.C. § 1014 criminalizes false statements to a federally-insured bank as well as the SBA in connection with a loan application. Under the statute, the government must show that the defendant had the specific intent to influence the bank to provide the loan. This element can be demonstrated through circumstantial evidence. For example, the Fifth Circuit has held that specific intent may be inferred when a person makes a false statement that has the capacity to influence the bank.[4] Borrowers who fraudulently obtain loans may also be prosecuted under the mail fraud, wire fraud, and bank fraud statutes, 18 U.S.C. §§ 1341, 1343, 1344. To prove wire fraud under 18 U.S.C. § 1343, the government must show that the defendant took part in a scheme that used electronic, interstate communications to defraud the victim of money or property. The mail fraud statute has the same elements except that it requires the use of mail to further the scheme. The use of the federal mails is sufficient. The government need not prove that the mailing crossed state lines. Similarly, the federal bank fraud statute criminalizes the “knowing execution of a scheme to defraud a financial institution.”[5] Thus, all three statutes require the government to prove that the defendant had a fraudulent intent to deprive the victim of money or property through a scheme to defraud. To establish the existence of a scheme to defraud, the government must prove the materiality of a defendant’s false statements or misrepresentations to the financial institution or victim. When examining materiality, courts will consider whether the misrepresentation would influence a rational decision maker in a meaningful way.[6]
Best Practices for Mitigating Criminal Liability and Preparing for an Audit
Given the current climate, and in light of Treasury Secretary Mnuchin’s statements, all businesses that borrowed PPP funds, and especially those that borrowed over $2 million should be prepared for an audit. It is also likely that the government will look to vigorously pursue criminal prosecutions in this area if the audit uncovers evidence of potential misconduct. Therefore, businesses ought to consider the following in connection with a possible federal audit or investigation related to the certifications made in connection with a company’s loan application under the PPP.
First, companies should make sure to preserve all documents supporting their loan applications. They should be sure to identify, in advance, key documents that provide the rationale and bases for their decision to apply for the loan, including those that justify the company’s certification that the loan was necessary to support ongoing operations and that other forms of liquidity were inaccessible, or that harm would have otherwise come to the business. These documents should be written contemporaneously to making the decision to apply for the loan, such as in a board resolution. Second, businesses should begin preparing employees for potential interviews with auditors. Any employee who played a role in the company’s decision to apply for the loan must be able to walk the auditor through the decision-making process and explain why the business needed the financial assistance for which it applied. Third, since any false or inaccurate information is “the fault of the borrower,” companies should, where appropriate, consider retaining counsel to advise them regarding eligibility status, any audit, or any resulting investigation that may be brought against them.
Additionally, businesses that are likely to be audited should adopt protocols to ensure that they remain in compliance with the CARES Act. For instance, businesses should create a procedure for overseeing the handling and use of the loan funds. While much of the government’s attention is currently focused on which companies received the loans, once the audits begin, the auditors are likely to examine how the funds were spent. Consequently, companies should use best efforts to ensure that the loan funds remain separate from the company’s other cash flow, and protocols should be implemented to verify that the funds are only allocated to expenses specified in Section 1109 of the CARES Act. Furthermore, all businesses that applied for loans should stay apprised of new developments related to the provisions of the CARES Act and any recently published guidance or interpretations. Since the CARES Act passed, the guidance on eligibility and use for PPP loans as well as forgiveness of the loans has continued to evolve. It is reasonable to believe that such guidance will continue to change, and it is imperative that all businesses have procedures in place to be aware of each new update.
Finally, and most importantly, companies should review whether their business needs still meet the requirements for PPP loan eligibility under the most recent guidelines. If not, companies should promptly return the funds. The government is allowing all borrowers to return the funds without penalty until May 14, 2020.
[1] Businesses in certain industries may have more than 500 employees. Check www.sba.gov for industry size standards.
[2] The SBA may also pursue civil fraud remedies under 31 U.S.C. § 3729-3733 (False Claims Act) as well as 31 U.S.C. §§ 3801-3812 (Program Fraud Civil Remedies Act).
[3] Other statutes include 18 U.S.C. §§ 1001 & 3571 (False Statements within Jurisdiction of United States); § 1031 (Major Fraud Against the United States).
[4] See United States v. Sandlin, 589 F.3d 749, 754-55 (5th Cir. 2009).
[5] See United States v. Bouchard, 828 F.3d 116, 124 (2d Cir. 2016).
[6] See United States v. Calderon, 944 F.3d 72, 85-86 (2d Cir. 2019).