Paycheck Protection Program Loans And Risk Of Government Investigation: Advice From Former Federal Prosecutors

The Paycheck Protection Program (PPP) has provided a needed lifeline to many small businesses struggling from the impact of the COVID-19 pandemic. However, various aspects of the PPP have also caused controversy.

Now government investigations have begun. These include probes by the Special Inspector General for Pandemic Recovery, Department of Justice (DOJ) prosecutors, state attorney generals, and congressional committees. The first criminal case involved a clear example of a fraudulent PPP loan application. Two men in New England are alleged to have applied for a PPP loan, certifying that they had “dozens of employees earning wages at four different business entities when, in fact, there were no employees working for any of the businesses,” according to the DOJ statement on the case.

All of this has had a chilling effect on the PPP. Many owners of small businesses are now worried about whether they were really eligible for the loans, what they need to do if audited, how to properly use the funds to make the loans forgivable, and the consequences of being accused of misuse. Numerous examples of the impact of the PPP rules on small businesses appear in many publications, from The New York Times (which calls them “complicated and confusing”) to Eater New York. These worries add to the underlying anxiety every business feels about when it will be allowed to fully reopen.

In my series of articles on Forbes.com, I’ve provided insights and counsel from experts on PPP loans. These articles feature advice from former federal prosecutors on whether to apply for the loan and how to prevent problems later on; from small business lawyers on what to do once you have the loan; and from a public relations pro on protecting your business reputation to avoid getting tarnished by negative media coverage of a PPP loan.

This article provides insights into whether to return the loan, government audits and investigations, and how to prepare for them. This guidance comes from four attorneys very experienced with government investigations: Andrew Goldstein, Daniel Grooms, Michael McMahon, and Erin Estevez at Cooley LLP. The first three authors are former federal prosecutors. Before joining Cooley, Andrew was one of the top deputies to Robert Mueller III in the recent Special Counsel investigation at the US Department of Justice. Andrew also served as chief of the public corruption unit at the US Attorney’s Office for the Southern District of New York.

1. How do you recommend a company (“company” refers also to nonprofits) think through whether to repay the Paycheck Protection Program (PPP) loan by May 14?

There is no single playbook for evaluating the risks of potential investigations and unwanted media exposure that come with participating in the PPP. At a minimum, companies should take two steps: 

(1) reassess their eligibility in light of recent guidance issued by the Treasury

(2) make sure they can document the accuracy of their certifications for their PPP loans

First, companies should confirm that, at the time they applied for the loan, they met the eligibility criteria, including, but not limited to, the SBA’s size standards (including affiliates) and the required loan application certification that “[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.”

In guidance related to this certification issued in recent weeks, through its Frequently Asked Questions (“FAQ”), the SBA in #31 stated that borrowers must show that they cannot “access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business.” This FAQ comes despite the CARES Act’s express waiver of the SBA’s usual requirement that borrowers specifically demonstrate they cannot obtain credit elsewhere. 

The SBA thus far has not defined what “significantly detrimental” means, but, in the same FAQ, stated that “it is unlikely that a public company with substantial market value and access to capital markets will be able to make the required certification in good faith, and such a company should be prepared to demonstrate to SBA, upon request, the basis for its certification.” In light of the SBA’s focus on the necessity for loan requests, borrowers should reassess their certifications with the new guidance in mind.  

Second, companies should ensure that they can document the accuracy of their initial certifications, including the necessity certification. Companies should pull together supporting documentation that includes, among other things, financial forecasts and reforecasts through at least the end of 2020, supporting data demonstrating the impact of the pandemic and associated stay-at-home orders, and evidence demonstrating that they considered the availability of other sources of capital and the terms on which it could be obtained. 

2. Do your recommendations change based on whether the company is a public company, large private company, or a “smaller” small business?

Not necessarily. Each company is different and the analysis is highly fact-specific. But regardless of size or ownership, companies must be prepared to support their eligibility for PPP loans and the accuracy of the certifications they made in applying for those loans. 

Recent attention has focused on larger loans and those taken by public companies. For example, the Select Subcommittee on the Coronavirus Crisis established by the House of Representatives announced on May 8 that it had sent letters “demanding that large, public corporations immediately return taxpayer funds that Congress intended for small businesses struggling to survive during the coronavirus crisis.” But given the widespread attention to the program, in the months and years ahead, investigative scrutiny is also likely to include private companies and smaller loans. 

3. After May 14, can a company still return all or part of the PPP loan? Is there a legal risk in doing it after that date?

Yes, to both questions. Treasury had announced and formalized on April 23 in SBA FAQ 31 that “[a]ny borrower that applied for a PPP loan prior to the issuance of this guidance and repays the loan in full by May 7, 2020 will be deemed by SBA to have made the required certification in good faith.” Subsequent guidance in FAQ #43 extended this safe harbor to May 14. After May 14, a company may still return all or part of its PPP loan, but would not be entitled to take advantage of the safe harbor and may be required to justify why it retained the funds past May 14 in the event the government initiates an enforcement action.

Failure to timely report and return an overpayment may also result in a violation of the federal False Claims Act, 31 U.S.C. § 3729, which carries steep fines and penalties.  Accordingly, borrowers should take care to assess their eligibility before May 14 and, if necessary, return the funds within the safe harbor.

4. Should a company provide any type of explanation to the SBA when it returns PPP loan funds? Does this depend on size of company and whether public or private?

No explanation is required, regardless of whether the company is public or private. According to the SBA FAQ 31 and 43, any borrowers who take advantage of the safe harbor and return PPP funds by May 14 “will be deemed by SBA to have made the required certification in good faith.” 

Borrowers should also bear in mind that any statements they make to the government could be used against them in a future enforcement proceeding. Accordingly, borrowers should consult an attorney before providing the government with any explanation of why it is returning PPP loan funds.

5. What companies are most at risk for an audit of their PPP loan?

The SBA has stated in FAQ # 39 that it “will review all loans in excess of $2 million, in addition to other loans as appropriate, following the lender’s submission of the borrower’s loan forgiveness application.”

But that does not mean that companies whose loan amounts fall below the $2 million threshold, or that do not seek forgiveness of their loans, are in the clear. The SBA has not defined the criteria it will use to determine when and whether to audit loans under $2 million. Any PPP loan, no matter the size and whether or not forgiveness is sought, can be subject to scrutiny by other government enforcement bodies.

6. What companies are most at risk for a government investigation that could lead to prison term and/or criminal or civil penalties?

Sham companies set up to receive PPP loan funds are obviously among the most at risk for government investigation. On May 5, 2020, for example, two individuals were charged in Rhode Island with conspiring to seek PPP loan funds, allegedly having claimed they had dozens of employees at four different business entities when there were no employees working for any of the businesses. While this is among the most egregious examples, anyone who knowingly makes false statements may be subject to criminal and/or civil liability under a variety of federal statutes, including 18 U.S.C. § 1001, 18 U.S.C. § 1014, and the False Claims Act, 31 U.S.C. § 3729. Companies whose “necessity” certifications seem implausible on their face may also be at greater risk for this kind of inquiry.

7. Should “smaller” small businesses be worried about the risk of getting investigated, or only larger ones?

It is smart for any business that receives PPP funds, no matter the size, to be mindful that an investigation is a real risk. Believing your company is too small for the government to care about, or that the government is too busy or preoccupied to pursue fraud during a crisis, is a mistake. The government’s memory is long and so are statutes of limitations, particularly in the criminal context. 

While the SBA, as a practical matter, may be limited in its ability to audit all loans, the Department of Justice has already taken several steps to sharpen its pandemic-related enforcement activities, including by directing, on March 20, 2020, all 93 U.S. Attorneys to prioritize detection, investigation, and prosecution of all Coronavirus-related fraud schemes. 

Companies that receive PPP funds also are subject to civil enforcement under the False Claims Act, which empowers and incentivizes private whistleblowers—who are often current and/or former employees—to come forward and bring fraud claims on behalf of the government. The government then has a period of time to investigate these claims, many of which it would never have learned about. If the government recovers money, the whistleblower is entitled, by statute, to a share of that recovery.

8. How should companies prepare now for the possibility of a government audit of their PPP loan?

As noted above, companies should immediately review, ideally at the board level, their initial eligibility for the PPP loan and ensure their certifications were accurate and made in good faith. Companies should memorialize their deliberations, either formally or informally, and ensure documents and calculations exist to support the “necessity” of the loan and their inability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not “significantly detrimental to the business.” 

To the extent practicable, supporting documentation should include financial forecasts and reforecasts through the end of 2020 and the impact the pandemic and work-from-home measures have had on the business. Companies should emphasize the workforce reductions that would be required (or the salary reductions, or the rehiring that would not have occurred) in the absence of the PPP funds.

Companies should also review public and internal statements by company representatives—such as in SEC filings, press releases, or to existing and prospective investors—for consistency with representations made to the government and the assessment of necessity.

9. What are the criminal and civil laws that could be used to prosecute and/or fine companies because of abuse or fraud with their PPP loan?

Multiple federal statutes prohibit the making of false statements in connection with loan applications involving federal money, including 18 U.S.C. § 1014, which prohibits “knowingly mak[ing] any false statement” in a loan application, and 18 U.S.C. § 1001, which prohibits making false statements to the government. Liability under either statute carries significant monetary penalties and potential jail time.

In addition, the False Claims Act, 31 U.S.C. § 3729 creates civil liability for any person who knowingly presents or causes to be presented a false claim for payment to the government. Given that the FCA is a civil statute, it imposes a lesser burden of proof on the government than criminal statutes. For FCA purposes, “knowingly” can mean having actual knowledge, or acting in deliberate ignorance or reckless disregard of the truth or falsity of the information. FCA fines and penalties can be steep, as the FCA allows the government to recover up to three times the amount of its actual damages—with damages in this context likely viewed by the government as the full amount of the loan—plus penalties for each false claim.

10. Do employees get some type of bonus payment from the US government for reporting any abuse or fraud by their company in applying for the PPP loan and in their use of the funds?

One reason the FCA has become such a powerful tool in the federal government’s fraud deterrence arsenal is its whistleblower provisions, which empower private individuals—often company employees—to bring suit on behalf of the government in exchange for a share of the government’s ultimate recovery. The whistleblower’s share typically ranges between 15% and 20%, but can be as high as 30%.   

11. What is Paycheck Protection Program “law” other than what’s in the CARES Act in Section 1102?  When companies try to make sense of what they can and cannot do, what is the legal significance of the FAQs from the SBA, other rules and information on the SBA website, and statements and tweets from elected and appointed government officials?

The only binding “law” governing the PPP program currently appears in the CARES Act itself and in the SBA’s Interim Final Rules, published in the Federal Register. The SBA’s FAQs and other guidance on the SBA website, and tweets or other informal statements from elected and appointed government officials, do not by themselves carry the force of law. 

During 2018, in a memo issued by then-US Associate Attorney General Rachel Brand, the DOJ clarified that it “may not use its enforcement authority to effectively convert agency guidance documents [such as the SBA’s FAQs and website] into binding rules.” That said, borrowers should neither ignore nor flout such guidance documents, because they will help shape the government’s enforcement priorities and affect the government’s evaluation of a company’s good faith in making its certifications.

12. What’s an inspector general and that person’s role in investigating and prosecuting waste, abuse, and fraud with PPP loans?

The Inspector General Act of 1978 authorized the establishment of Inspector General offices across various government agencies. Inspectors General protect the integrity of governmental programs and investigate fraud, waste, and abuse through audits, investigations, and evaluations, and use their authority to execute enforcement priorities. Inspectors General also often investigate internal employee complaints, and issue reports to their agencies and to Congress.  

The CARES Act has various oversight provisions. Among them it created the Special Inspector General for Pandemic Recovery (“SIGPR”), an independent inspector general within the Treasury Department, to conduct, supervise, and coordinate audits and investigations of the making, purchase, management, and sale of loans, loan guarantees, and other investments made by the Secretary of the Treasury under the CARES Act. In carrying out the SIGPR’s mission, the CARES Act authorized SIGPR to issue subpoenas, and to seek and execute search and arrest warrants, although prosecuting authority lies with DOJ, not SIGPR.

13. What’s the difference between a PPP investigation by the inspector general, the local US Attorney (and the DOJ if separate), and congressional committees? What’s common in how a company should respond to them?

PPP loan recipients may face scrutiny from a variety of oversight bodies looking to ensure PPP loan funds were properly obtained and properly used. While the SIGPR and congressional committees may subpoena documents for investigatory purposes, prosecuting authority lies with the DOJ (either the local U.S. Attorney or main Department of Justice in Washington, DC). 

One key difference between congressional investigations and those typically conducted by an inspector general or prosecutor is publicity.  Congressional investigations tend to be very public from the beginning.  For example, Congress publicly sent letters to several companies last week demanding that loan money be returned or else the companies would be investigated. DOJ and inspector general investigations, on the other hand, typically are conducted outside the public eye until a result is reached and action brought. The court of public opinion may be more important to a company than the outcome of an investigation. 

Regardless of who is doing the investigating, companies need to be careful to respond truthfully and that they have vetted any and all information provided to an investigator. A company that was entitled to a PPP loan and made good faith certifications can still get in trouble—even years later—by not responding appropriately to an investigator’s inquiries.

See my other articles on Forbes.com about the Paycheck Protection Program:

Paycheck Protection Loan Backlash: How To Defend Your Business Reputation And Avoid Getting Shake Shacked

You Got Your Paycheck Protection Program Loan. Now What? Advice From Small-Business Lawyers

How To Avoid Going To Prison For Your Payroll Protection Program Loan: Advice From Former Federal Prosecutors

Free Money For Small Business? Beware Legal Risks Of Paycheck Protection Loan Program Until More Guidance Issued

SBA Says Paycheck Protection Program Loans Are Not For Larger ‘Small’ Businesses With Liquidity Access