Litigation and Regulatory Concerns for Compliance-Oriented Lenders Who Make Paycheck Protection Program Loans

To help our clients navigate the coronavirus (COVID-19) crisis, Arnold & Porter has established a Coronavirus Task Force covering a wide range of issues and challenges. Subscribe to our "Coronavirus (COVID-19)" mailing list to receive our latest client Advisories and register for upcoming webinars.

*          *          *          *          *

Introduction

The Paycheck Protection Program (PPP) component of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), P.L. 116-136, as implemented by the Small Business Administration's (SBA) Interim Final Rule, 13 CFR Part 120, is an unprecedented expansion of the Small Business Act that authorizes up to $349 billion—subsequently increased to $659 billion—in short-term loans for small businesses adversely impacted by the COVID-19 crisis. Given the exigent circumstances and the millions of prospective applicants, the Interim Final Rule significantly modifies existing SBA loan procedures to expedite loan processing and approval and to encourage the participation of existing and new SBA lenders. Those changes include significantly reduced underwriting requirements, a 100% federal guarantee with no guarantee fee, the possibility of 100% loan forgiveness, no collateral or personal guarantee requirements, and generous origination fees. Perhaps most importantly, the Interim Final Rule and the two-page PPP application, SBA Form 2484, make clear that lenders are entitled to rely on borrower "attestations" of their eligibility and the accuracy of documentation submitted with their applications and that the SBA will "hold harmless" any lender who does so.. In other words, the Interim Final Rule effectively eliminates the majority of the lenders' traditional underwriting responsibilities, other than basic anti-money laundering (AML) and customer identification programs (CIP).

For institutional lenders and other market participants that were around prior to the last financial crisis and who were involved in the residential mortgage market, these PPP underwriting guidelines will be reminiscent of the "stated income" and other reduced or no-documentation loan programs that were widespread prior to 2008 during a time of rapid home price appreciation. Those programs generally permitted originators to rely on borrowers' representations about their employment, income, or assets without meaningful verification, and borrowers often used the loans to purchase second homes, investment properties, or residences they could not afford unless they could sell or refinance at a higher value within a reasonably short period of time. The pitfalls of those programs and their susceptibility to abuse were exposed in the housing market collapse when it became apparent that unscrupulous borrowers and originators had taken advantage of that reduced underwriting to obtain and originate loans that would not ordinarily have been approved. Underwriters and sponsors of securitizations of pools of these loans paid out billions in settlements and penalties when their reliance on borrowers' representations proved to be misplaced. While numerous borrowers were prosecuted, the bulk of subsequent civil litigation and government enforcement activity was focused on the originators and sponsors who made and sold these loans.

In response and in the years since, compliance-oriented lenders have beefed up their underwriting and compliance processes, including rigorous validation of borrower information and documentation, use of third-party fraud-detection and valuation programs, and other tools to detect fraud in loan applications. The existing SBA program was no exception. For example, the SBA has limited the government's participation and guarantee to 75-85% for most loans, which leaves lenders with sufficient "skin in the game" to incentivize compliance. Similarly, the SBA has the right to revoke its guarantee for loans that ultimate turn out to be ineligible or fraudulent. And, of course, there is always the prospect of enforcement actions and penalties if lenders are found to have neglected their gatekeeper role as a delegated underwriter for the government.

Compliance-oriented lenders participating in the PPP now face a dilemma: should they accept the invitation or follow the direction of the SBA and Congress to shelve these underwriting requirements and approve PPP loans with essentially "no questions asked," relying on the government's assurance that they will be "held harmless" for doing so? Or, mindful of the past, should they adhere to some or all of their traditional underwriting practices and reject applications where they cannot validate applicants' eligibility or supporting documentation? As is already becoming clear in the early days of this program, there is risk associated with either path.

It would not be unreasonable for an otherwise compliance-oriented lender to conclude that it is permissible or even advisable—and in service of the stated objective of the CARES Act to get as much money into the hands of struggling businesses as quickly as possible—to abandon its efforts to validate borrower documentation in light of the safe harbor apparently offered by the Interim Final Rule. Indeed, it may be perceived to be riskier to do more than the Rule requires. For example, if a lender conducts due diligence on borrower documentation and finds it to be deficient, inconsistent, or even fraudulent, but extends the loan nonetheless, can it still be said to have relied on the borrower attestation and avail itself of the safe harbor? The Interim Final Rule does not say. Conversely, if a lender continues to employ its more rigorous CIP and underwriting standards and rejects applicants who are unknown to it or who submit fraudulent or deficient documentation, will the lender be accused of discriminatory lending practices if it turns out that the rejected applications come disproportionately from minority-owned businesses or particular communities? This is not a hypothetical question. Already, Senator Ben Cardin (D-Md), the Ranking Member of the Senate Committee on Small Business & Entrepreneurship has stated that lenders that are imposing restrictions on eligibility not provided for in the CARES Act are engaging in "redlining by another name." Similarly, one of the largest institutional SBA lenders in the country has been sued for initially limiting eligibility to applicants with an existing banking relationship with the institution. See Profiles, Inc. v. Bank of America Corp, et al;, 1:20-cv-00894 (D. Md.). Other large lenders apparently have imposed similar limitations, ostensibly intended to help them manage the avalanche of applications by focusing in the first instance on their existing customers who they know and presumably have already vetted, allowing for faster underwriting and reducing the risk of fraud. Although the Court in the Profiles case has held that the CARES Act does not supply a private right of action and opined that lenders should be permitted to exceed the requirements of the CARES Act, several members of Congress have already questioned the practice and have demanded that the Treasury Department prohibit lenders from imposing application or loan requirements outside the scope of the CARES Act. See April 6, 2020, letter to Hon. Steven Mnuchin from Sen. Chris Van Hollen and Mem. David Trone.

There also are competitive and financial considerations. Rigorous loan underwriting, including CIP and AML compliance and review of supporting documentation, takes time. In the tidal wave of new applications, many by businesses with no pre-existing relationship with an approved SBA lender, prospective borrowers will quickly learn which institutions are making loans fast, and with little or no questions asked. Those lenders employing sound, pre-crisis, underwriting procedures will quickly find themselves at a competitive disadvantage to those who are not so rigorous. They may also face reputational harm. In response to the application limitations that are the subject of the Profiles case, Senator Marco Rubio on April 3 tweeted his criticism of the practice, noting "The requirement that a #SmallBusiness not just have a business account but also a loan or credit card is NOT in the law we wrote & passed or in the regulations…They should drop it. This money is 100% guaranteed by fed govt." That tweet has already been retweeted millions of times, often with unkind words for the bank. It is easy to imagine similar criticisms leveled against lenders who actually substantively review and validate PPP applications and supporting documentation and reject applications that appear to be deficient, whether as a result of borrower error or outright deception. With the supply of funds allocated to PPP already obviously insufficient to meet demand, the delay resulting from a stalled or rejected application could mean the difference between an otherwise deserving borrower's getting a loan or not.

Moreover, most lenders of any size rely on the securitization market to finance these loans. While it is not yet apparent whether such a market will develop, lenders likely will seek to do so in order to move billions of dollars of loans off of their balance sheets and free up capital for new originations. But what types of representations and warranties will rating agencies and investors require? And what kinds of representations and warranties could a lender even give if it has blindly relied on borrower attestations as to eligibility and documentation? While the 100% government guarantee should support "light" representations and warranties, it is difficult to imagine that market participants will accept no representations if they perceive any risk that the guarantee or forgiveness could be in jeopardy for ineligible or fraudulent loans. The potential inability of large lenders to securitize these loans could cause them to limit their lending under this program, contrary to the objectives of the Act.

Finally, lenders must decide how much stock they can put in SBA's assurances that they will be held harmless for relying solely on borrower attestations and that they will not be subject to enforcement action or penalties if it turns out that they originated ineligible or fraudulent loans by doing so. Numerous watchdog organizations and former regulators have already predicted that the level of fraud in the CARES Act program generally, and the PPP specifically, will be unprecedented. Given its $659 Billion (and potentially growing) price tag, even a moderate incidence of fraud will divert hundreds of millions of dollars from deserving businesses. Presently, in its effort to rapidly deploy these rescue funds, the government says that it is willing to accept that risk and that compliant lenders will not be held responsible. But if history is any guide, the subsequent autopsy of this response, and the banks' role in it, will be informed by a large dose of hindsight together with short memories of the exigent circumstances that required rapid action in the face of imperfect information. And, as time passes and flaws in the hastily-written Interim Final Rule are inevitably discovered, will the SBA amend the Rule to combat fraud by, for example, withdrawing or curtailing its guarantee on objectively fraudulent loans, rejecting forgiveness requests from borrowers who turned out to be ineligible, or even going back on its promise of clemency for lenders who relied on objectively false borrower attestations? This would not be the first time that a government agency has done so. While the SBA may well be taken at its word, it does not speak for Congressional oversight committees, prudential regulators, FCA whistleblowers, or the SEC and DOJ, to name a few. Even if post-crisis enforcement activity is focused primarily on borrowers rather than lenders, as is currently being suggested, even the most careful PPP lenders should expect to be drawn into what is likely to be years of that investigatory activity. As was borne out in the last financial crisis, it is far easier and more efficient to investigate lenders to find pools of fraudulent loans than to chase millions of individual borrowers. And if certain lenders are found to have originated disproportionately higher volumes of ineligible or fraudulent loans, will regulators and law enforcement really turn a blind eye?

Specific Litigation Risks

These circumstances arguably leave financial institutions in a no-win situation. Banks may be whipsawed between exposure to litigation risk under the Fair Lending Act on the one hand, and the False Claims Act on the other. That is, financial institutions face the probability of being attacked under the Fair Lending Act for failing to make loans as quickly and as broadly as borrowers would like, but also subject to False Claims Act litigation based on hindsight-criticism for making loans without discovering borrowers' misrepresentations or fraud. Financial institutions making PPP loans are also at risk of being the target of complaints alleging claims for a variety of business torts, including negligence, misrepresentation, unjust enrichment, and tortious interference with business relations, as well as state UDAP laws. Indeed, we have already seen two distinct waves of litigation against lenders—and to some extent borrowers—arising out of the PPP program.

Claims Under the CARES Act

The first wave of litigation relating to the PPP program is reflected in the Profiles case discussed above, along with similar actions brought in federal courts in Texas, Sherer v. Wells Fargo; H-20-1295 (S.D.Tex.), and California, BSJA v Wells Fargo; 2:20-cv-03588 (C.D.CA). In those putative class actions, plaintiffs alleged that lenders violated the CARES Act by adopting eligibility requirement for PPP applicants. The banks imposed such restrictions to comply with Know Your Customer requirements and to expedite processing. Plaintiffs argued that the restrictions were inconsistent with the CARES Act and prejudiced non-customers of the relevant lenders. The courts in Profiles and Sherer denied motions for Temporary Restraining Orders (and the Profiles court also denied a motion for a preliminary injunction). Both courts held that the plaintiffs had failed to show irreparable harm, and the Profiles court also held that there is no private right of action under the CARES Act. These decisions may not be the last word—Profiles is on appeal and there is more to come in Sherer. Regardless, events may overtake these kinds of actions, as the first round of PPP funding has been exhausted and a second wave of litigation is upon us.

A second category of CARES Act litigation comprises claims by purported borrower-agents who allege that lender banks are required to pay them fees on PPP loans. A putative class action complaint filed in federal court in California seeks to recover potentially hundreds of millions of dollars from a proposed class of defendant lenders. American Video Duplicating, Inc. v Royal Bank of Canada, et al; 2:20-cv-04036 (C.D.CA) . On its face, the CARES Act and PPP rules permit, but do not appear to require, lender banks to agree to pay agents to assist in loan preparation (with disclosures to borrowers).

Common Law Business Torts, State UDAP, and Fair Lending Act

Although the time may have passed for efforts to enjoin lenders from imposing restrictions on borrower-eligibility, there are a number of actions already on file seeking damages under common law and state statutes, attacking the way that lenders have administered the Paycheck Payment Protection loan program. These putative class action complaints, filed in courts across the country, allege that banks have favored their own customers, including large, publicly traded companies and national restaurant and hotel chains, over mom-and-pop borrowers. For example, Lincoln v PNC; 3:20-cv-02824-TSH (N.D.CA), and Outlet Tire Center v. Chase; 2:20-cv-03603 (C.D.CA), attack lenders for allegedly giving "concierge" service to their private banking and commercial clients by expediting their applications at the expense of smaller businesses or those without an existing banking relationship. Plaintiffs in these cases allege that lenders are engaging in self-dealing by making higher-dollar loans that generate greater fees, and by ensuring the health of their own borrowers to protect the lenders from other losses.

Similar actions are targeting both borrowers and lenders. For example, in Sha-Poppin Gourmet Popcorn v. Chase, et al.; 1:20-cv-02523 (N.D.Ill.), a putative class sued the national restaurant chain Ruth's Chris, a proposed class of defendants comprised of similarly "favored" borrowers, and JP Morgan Chase Bank. The plaintiffs allege that Chase permitted Ruth's Chris and other existing bank-customers to "cut in line," and streamlined their applications while leaving smaller businesses out in the cold. Plaintiffs seek money damages from Ruth's Chris and other "favored" borrowers under a theory of unjust enrichment. They also present a range of tort claims against the lender, including breach of duty, misrepresentation, intentional interference with economic advantage, and unjust enrichment, as well as claims under state UDAP or deceptive practices statutes.

Members of Congress have expressed concern over lender-created restrictions that may favor established customers and larger businesses, regardless of their motivation, and lenders could become the target of Congressional scrutiny and private litigation based on an alleged failure to make loans, or to make them quickly enough, under the CARES Act.

Similar to the PPP, the CARES Act mortgage relief program requires lenders to offer forbearances with respect to certain mortgage loans. The mortgage relief program presents risks of fraud or misrepresentation by borrowers, and underwriting challenges for lenders. In addition, there is significant concern that this rush of forbearances could later give rise to claims for violation of the Fair Lending Act if, in retrospect, those forbearance decisions have a disparate impact on borrowers or otherwise have a discriminatory effect.

False Claims Act

On the flip side, financial institutions will almost certainly be criticized for allegedly failing to discover or guard against fraud or misrepresentation by borrowers, or for negligently or falsely certifying borrowers' compliance with CARES Act requirements. It is almost inevitable that hindsight will lead to claims under the False Claims Act brought by the government, qui tam actions brought by private plaintiffs, consumer class actions, and shareholder derivative suits, all based on the belief that lenders should have done more to ferret out fraud, misrepresentations, or even honest mistakes. Although Treasury guidance is that PPP lenders can rely on borrowers' certifications of eligibility, experience has shown that regulatory assurances and Congressional encouragement to make loans quickly, without lender-imposed restrictions, are unlikely to insulate banks from the cost of False Claims Act litigation, even if they escape liability in the end.

Contract and Fiduciary Duty Claims

As in the aftermath of the 2008 crisis, lenders, servicers, and trustees of asset-backed securities trusts and other special purpose vehicles face litigation risk from trying to balance forbearance and servicing decisions with the strict terms of trusts, securitization agreements, and other contracts and fiduciary duties to investors. The experience of the Residential Mortgage Backed Securities litigation, still fresh for many, could present itself again in a slightly different form, with claims for breach of contract, breach of fiduciary duty, and misrepresentation potentially leveled at anyone involved in originating, servicing, buying, or selling CARES Act loans or investment backed securities. As in other matters of contract interpretation and performance, the doctrines of Force Majeure, Impossibility, Impracticality—and contractual provisions for Material Adverse Event or Material Adverse Change—will be front and center.

Steps To Take To Minimize Risk

The key takeaways for now are to maintain meticulous records of compliance efforts relating to the application for, and distribution and use of, CARES Act assistance; those records will be important when defending against any manner of claims brought by the government or private parties. Informal communications, including emails, should not use short-hand or a flippant tone that could give a false impression about lender or borrower motives or intentions. As in 2008, consider duties to, and rights of, all stakeholders, including investors in asset-backed securities, shareholders, and regulators

Notwithstanding the SBA's apparent invitation—and Congress's urging—to do so, compliance-oriented lending institutions should probably not wholesale abandon their carefully constructed underwriting and compliance programs for the PPP. Rather, they should review and consider streamlining them to allow for prompt application review and approval, while still maintaining basic procedures to ferret out ineligible borrowers and fraudulent applications. Although this issue is still being litigated in the courts and the court of public opinion, it is reasonable for lenders to initially focus on businesses already known to them, which can be validated more quickly. Notwithstanding an applicant's attestation, applications and supporting materials should be reviewed in a manner at least minimally designed to detect "red flags" of fraud for further scrutiny, such as irregularly formatted or handwritten records, missing documents, and obvious mismatches among headcount, payroll, and tax records. At the same time lenders must continue to actively audit their loan approvals and rejections for signs of inadvertent redlining or discriminatory practices. While lenders who strike this balance may be subject to near term criticism for slowing the flow of rescue funds to struggling businesses, they are almost certain to be viewed and treated more favorably through the lens of hindsight than those lenders who are discovered to have willfully or blindly dispensed those funds to borrowers who were not entitled to them, at the expense of those who were and federal taxpayers.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.