Fraud in the Time of COVID-19: White Collar and Regulatory Enforcement of the CARES Act

To help our clients navigate the coronavirus (COVID-19) crisis, Arnold & Porter has established a Coronavirus Task Force covering a wide range of issues and challenges. Subscribe to our "Coronavirus (COVID-19)" mailing list to receive our latest client Advisories and register for upcoming webinars.

*          *          *          *          *

INTRODUCTION

The scope and severity of the economic fallout from the COVID-19 pandemic is unprecedented. Never before have so many industries been halted and businesses forced to close over the course of just a few weeks. In response, on March 27, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (the CARES Act),¹ which allocated more than $2 trillion in emergency relief to individuals, businesses, and other entities adversely impacted by the pandemic. Even though it was the largest stimulus package in US history,² the CARES Act was not enough. Four weeks later, on April 24, Congress allocated an additional $483 billion to certain CARES Act programs.³

While the scale of the government's spending is extraordinary, the approach itself is not novel. The past two decades are replete with examples of the government's addressing the most serious economic needs with a massive influx of funding and emergency assistance. Inevitably, those financial packages were fashioned in some haste in order to provide meaningful aid as quickly as possible.

That dynamic results in two phenomena that enhance the risk for those who participate in these new programs. When time is of the essence, statutes and regulations are often imprecise and agency guidance can be vague and subject to varying interpretations. At the same time, regulators and law enforcement officials who are charged with policing eligibility criteria for new relief programs face enormous pressure to prevent individuals and entities from taking unfair or illegal advantage of them and to act against those who have done so.

The sheer size and scope of the CARES Act, and the speed with which Congress enacted the legislation, highlights those risks. For example, neither the text of the CARES Act nor subsequent guidance from the Small Business Administration (SBA) clearly defines the "need" for funds that makes a small business eligible for a loan under the new Paycheck Protection Program (PPP). As a result, borrowers who certify that they meet that standard may face scrutiny from regulators or others who interpret it differently.

In addition, there is already public outrage about certain companies' receiving money to the detriment of those most in need, and there are inevitably others who will have obtained funds based on intentional misrepresentations. As a result, Congress, law enforcement officials and other regulators — who are concerned with both the letter and the spirit of the law — are already embarking on vigorous efforts to ferret out those who may never have been entitled to benefit from the CARES Act and those who have done so through fraud.

In fact, the CARES Act itself allocated approximately $190 million to entities that monitor and identify fraud, waste, and abuse related to the Act and it created a new Special Inspector General for Pandemic Recovery to oversee the Treasury Department's disbursement of CARES Act funds. In addition, in response to public outcry regarding the eligibility of certain borrowers who received loans from the first tranche of CARES Act funding, the Secretary of the Treasury has announced that the SBA will automatically audit all loans exceeding $2 million and would spot-check smaller loans. The Secretary also emphasized that borrowers face criminal liability for making false certifications in connection with relief applications, and the Assistant Attorney General for the Criminal Division of the Department of Justice (DOJ), has announced that efforts are already underway to detect and address fraud in connection with the CARES Act.⁴ In fact, just yesterday, the DOJ brought its first prosecution in the District of Rhode Island against two PPP applicants who sought to obtain more than a half-million dollars in relief to cover payroll costs for employees who, contrary to the applicants' certifications, allegedly did not exist.⁵

Separate from the PPP, the CARES Act establishes programs that provide substantial sums of money to the healthcare, food and nutrition, housing, education, travel and labor industries.⁶ Participants in these industries will be subject to oversight and regulatory enforcement not only by enforcement officials and regulators in the new positions created by the Act, but also by the pre-existing Inspectors General with investigative jurisdiction for relevant agency's programs.

Congress, too, will be heavily involved in oversight of CARES Act spending. The Speaker of the House of Representatives has created a Select Committee on the Coronavirus Crisis, and several Representatives and Senators who have called for hearings to review the SBA's administration of the relief programs and have also declared that they will use subpoena power to determine whether participants made false certifications.

The private bar may also play a role. Lenders, borrowers, grantors and grantees, should be concerned about the threat of class action lawsuits brought by private individuals,⁷ civil suits brought by those who were locked out of CARES Act programs, whistle-blowers, and False Claims Act litigation by qui tam relators or the DOJ seeking treble damages from borrowers who obtained government funding based on false certifications.

Those who have chosen to participate in programs established under the CARES Act, or are considering whether to do so, should do everything they can do now to mitigate the risks of examinations and evaluations that can and will take place months or years later. Every borrower, lender, and applicant for other CARES Act assistance should maintain thorough documentation justifying their decisions to participate in the Act's programs, their eligibility to do so, and demonstrating that they have used the funds consistently with the Act's language and spirit.

Drawing on the enforcement history of other relief programs, this Advisory explores the white collar enforcement activities that are likely to follow the disbursement of funds under the CARES Act, and suggests best practices for those considering whether to borrow, lend, or apply for money under its programs. Prospective CARES Act participants should consult with counsel when applying for CARES Act relief if they are concerned about their potential liability. As history has made all too clear, simply being the target of an investigation, or a defendant in a criminal or civil action, involves enormous economic and reputational costs, even if no wrongdoing is ever found.

THE CARES ACT

The CARES Act was designed to provide "fast and direct economic assistance for American workers, families and small businesses, and preserve jobs for our American industries."⁸ Included in that assistance are the PPP⁹ and the Economic Injury Disaster Loan Program¹⁰ administered by the SBA with assistance from the Treasury Department. The SBA has also enlisted the assistance of approved lenders to process PPP loan applications from eligible borrowers.

To take advantage of CARES Act relief, prospective borrowers must certify that they meet eligibility requirements and agree to comply with certain operational and governance conditions. Unfortunately, those requirements and obligations are less than precise, and courts, investigators, prosecutors, and others are likely to interpret them differently, particularly as they take a retrospective look and try to distinguish between those who made mere good-faith mistakes and others with more nefarious intent.

Perhaps the most problematic ambiguity that has surfaced so far is the degree of "need" that renders a small business eligible for a PPP loan. While the PPP application requires applicants to certify in good faith that "[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant,"¹¹ neither the application nor the CARES Act defines the requisite standard of necessity. Then, on April 23, after more than one million businesses had received PPP loans, the SBA issued guidance instructing borrowers to assess their need by taking "into account their current business activity and their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business." This guidance also provides that "it is unlikely that a public company with substantial market value and access to capital markets will be able to make the required certification in good faith, and such a company should be prepared to demonstrate to SBA, upon request, the basis for its certification." ¹²

This guidance created substantial questions about how businesses should evaluate "their ability to access other sources of liquidity" and what meets the threshold of "significantly detrimental." At the very least, it is clear that this guidance has retroactively raised the standard for what many applicants believed would qualify as a "need" for the loan. Indeed, the SBA itself acknowledged the significance of the change: it gave borrowers who received loans prior to April 23 until May 14 to return the funds if they concluded that they did not qualify for the loan under the newly articulated standard.¹³ Recognizing that borrowers need additional time to work through the implications of the change, and the consequences of choosing to return or keep PPP funding, the SBA announced on May 5 that it "intends to provide additional guidance on how it will review the certification prior to May 14, 2020."¹⁴ In the meantime, at least one group of PPP recipients has brought a civil lawsuit seeking an injunction against the implementation of the SBA's new guidance on the ground that is inconsistent with the language and intent of the CARES Act.¹⁵ And in a number of high profile instances, some businesses have begun to return the funds that they have borrowed under the Act—some for reputational reasons, but others because they are concerned about whether they have met the new, higher standard for "need";

Notwithstanding a lack of clarity, it is incumbent upon applicants to ensure that the information to which they are attesting is current and accurate. Borrowers who certify falsely, or who improperly spend the funds, could face administrative sanctions, civil penalties, and criminal liability.¹⁶

Lenders are also not immune from liability under the CARES Act. Although the SBA has told approved lenders who process loan applications that they can rely on the statements in borrower applications, lenders still may be subject to civil suits by aggrieved borrowers who were locked out of the Act's reliefs programs, and the government or qui tam relators under the False Claims Act. In the same vein, lenders may be criminally prosecuted under various statutes¹⁷ for making and attesting to false statements in performing their underwriting obligations to the SBA. Even if such suits are not meritorious, the process is costly, the risk to reputation substantial, and the price of settlement potentially high.

In addition to these loan programs, the CARES Act also creates other programs that provide economic relief in the form of loans and outright grants to the healthcare, food and nutrition, housing, education, travel and labor industries, which are already subject to oversight and regulation by industry-specific federal agencies. The amounts of money are substantial, exceeding $500 billion.

ENFORCEMENT UNDER THE CARES ACT

There will be no shortage of agencies investigating individuals and entities who commit fraud and other wrongdoing in connection with CARES Act funding. The SBA Office of the Inspector General (SBA OIG) and the newly established SIGPR are both armed with subpoena power and the authority to request and execute search and arrest warrants, and are charged to "conduct, supervise, and coordinate audits and investigations" of the Treasury Department's management of programs administrated under the CARES Act.¹⁸ And like all Inspectors General, they must "report expeditiously" any violation of federal criminal law to DOJ. Indeed, Inspectors General from all federal agencies routinely conduct investigations together with prosecutors at DOJ in Washington DC and in US Attorney's Offices throughout the country.

Even before passage of the CARES Act, the Attorney General had already directed the United States Attorneys "to prioritize the detection, investigation, and prosecution of all criminal conduct related to the current [COVID-19] pandemic."¹⁹ And apparently, the DOJ's efforts to detect and address fraud, including through the use of data analytics tools, are well underway.²⁰

The CARES Act also created and funded the Pandemic Response Accountability Committee (the PRAC), whose mission is preventing and detecting "fraud, waste, abuse, and mismanagement" in connection with funds distributed pursuant to the CARES Act and any other COVID-19 relief legislation, and mitigating "major risks that cut across program and agency boundaries."²¹ Although the PRAC is a new entity, it is not operating on its own. Robert Westbrooks, a veteran Inspector General, is the executive director of the PRAC, whose membership includes Inspectors General from at least nine federal agencies. In addition, the PRAC is a Committee of the Council of Inspectors General on Integrity and Efficiency, and may coordinate and collaborate with investigations led by various Inspectors General and conduct investigations of its own. In fact, the PRAC's review of the federal COVID-19 response has already begun.²² Finally, the CARES Act provides additional funding to the preexisting nonpartisan congressional watchdog Government Accountability Office, and creates a bipartisan Congressional Oversight Commission to oversee economic stability efforts by the Treasury Department and the Federal Reserve Board.

Finally, small businesses and lenders are not the only entities that should be concerned about enforcement of the CARES Act. Because the Act includes enormous sums of money as loans and outright grants to various industries, there will undoubtedly be vigorous audits and investigations by Inspectors General from the agencies regulating those industries — including those at the Department of Housing and Urban Development, Department of Labor, Department of Agriculture, Department of Health and Human Services and the Department of Education, among other agencies.

PAST RELIEF PROGRAMS

Recent history proves the point: when the government has provided swift and vast expenditures of funds, aggressive enforcement activities have followed. That pattern has been especially true when relief programs, like the CARES Act, have themselves funded investigatory and oversight bodies.

For example, following the financial markets' collapse in 2008, the Emergency Economic Stabilization Act of 2008 created the Troubled Asset Relief Program (TARP), a $431 billion program designed to facilitate the federal government's purchasing of toxic assets from financial institutions.²³ The statute also created the Special Inspector General for the Troubled Asset Relief Program (SIGTARP) with the authority to oversee and police TARP's administration. In the decade that followed, investigations by SIGTARP resulted in hundreds of referrals for criminal prosecution and the recovery of over $11 billion related to fraudulent schemes associated with TARP funding.²⁴

The CARES Act's SIGPR is largely modeled after the SIGTARP. Here, of course, the CARES Act's $2 trillion price tag dwarfs the amounts that the federal government disbursed under TARP. If the SIGTARP's oversight efforts are a sign of what is to come, the SIGPR will be an aggressive driver of investigations and referrals for criminal prosecution and other law enforcement actions.

Other examples of efforts to actively police fraud associated with federal relief programs include the appointment of an Inspector General to oversee the disbursement of the approximately $800 million Hurricane Sandy Relief bill²⁵, the Hurricane Katrina Task Force to oversee the disbursement of monetary relief provided by the Federal Emergency Management Agency and the American Red Cross²⁶, and the Office of the Special Inspector General for Afghanistan Reconstruction to perform the same function related to the $136.97 billion for associated programs.²⁷ These regulators' efforts resulted in hundreds of referrals for criminal and civil investigation, leading to prosecutions and the recovery of millions of dollars that were procured by fraud.²⁸

This time around will be no different. In light of the far-reaching economic impact of the COVID-19 pandemic and the unprecedented size of the government's relief package, CARES Act participants should expect that the efforts to combat fraud will be more robust than ever.

BEST PRACTICES

The CARES Act is a bit of a moving target. For example, while, the Act states that the purpose of the PPP is to provide assistance to small businesses that have been "adversely impacted by COVID-19," the SBA's April 23 guidance signaled that the PPP was actually intended to provide assistance to a much narrower class of borrowers. This disconnect means that PPP participants should be prepared for investigations into any loan where the business's economic situation fell outside the more narrowly defined class of borrowers that the guidance identifies. And, of course, the Secretary's vow to audit every borrower who received more than $2 million means that the odds of avoiding scrutiny are low.

Entities undertaking this review should carefully evaluate whether any information in their applications requires correction. And those that received PPP loans prior to April 23, but have since determined that they do not meet the elevated standard of "need," have until May 14 to return all or part of the loans. The Secretary has promised that the SBA will deem those who repay the loan in fully by May 14 to have made the required certification in good faith.

Other circumstances that may heighten the risk of investigation include loans to businesses that: (i) have been the target of regulatory investigations in the past; (ii) whose owners or high-ranking employees have been the target of such investigations; (iii) do not seem to be of the kind clearly impacted by COVID-19; (iv) do not experience a drop in revenue; (v) have access to cash from other investors or lenders; (vi) pay executive bonuses at or around the time of funding; and (vii) increase headcount in the months following receipt of funding. The media has already started questioning the eligibility of borrowers who exhibit these red flags.²⁹

In considering whether to apply for a PPP loan, a prospective borrower should assess, among other things, whether there are reasonable grounds to believe that, because of the COVID-19 pandemic, the business will suffer a significant decrease in revenue in the near future that will require a reduction in headcount, or runs the risk of bankruptcy. The applicant should also be cognizant that the PPP application requires a good-faith certification that all of the facts in the underlying documentation are true. The breadth of this certification increases a borrower's exposure to liability for fraud.

There are certain steps that entities or individuals who participate in the PPP or any CARES Act program should take to prepare for future inquiries. Participants should review their compliance procedures and record retention policies, verify that all information submitted to the government is accurate, memorialize decision making in connection with the application process, monitor changed circumstances and new information, and segregate any CARES Act funds from other operating funds. Participants should also retain documentation supporting a borrower or grantee's eligibility to participate in the CARES Act and the use of Act proceeds. Ultimately, those who wish to avoid investigations and prosecutions are advised to consider and comply with the spirit, not just the letter, of the law.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.