The Federal Reserve Board recently assessed a $2.3 million fine against New York-based Popular Bank for processing six Paycheck Protection Program loans that had significant indicia of potential fraud.

The Federal Reserve's action was premised upon violations of the federal Bank Secrecy Act, which requires financial institutions to reasonably verify the identity of their customers and to document, investigate and report suspicious activity.

While the federal government has to date undertaken widespread fraud enforcement against recipients of COVID-19 relief funds, this is the first action against a financial institution for BSA violations arising from processing of PPP loans.

The Federal Reserve's action indicates that federal banking regulators are joining the federal government's multi-agency fight against pandemic fraud and that the federal government's fraud crackdown is expanding to financial institutions that disbursed COVID-19 relief funding.

Any financial institution that is concerned about civil or criminal exposure based upon its participation in PPP or similar aid programs should undertake an immediate internal investigation and consider self-disclosure of any improper conduct to federal authorities in order to mitigate risk.

The CARES and Bank Secrecy Acts

Enacted in 2020, the Coronavirus Aid, Relief, and Economic Security, or CARES, Act provided emergency financial assistance to businesses through the PPP in the form of forgivable loans to cover specific expenses. Lenders that originated these loans were entitled a fixed fee ranging from 1% to 5% from the Small Business Administration.

The federal Bank Secrecy Act, enacted in the 1970s, requires that financial institutions document, investigate and report suspicious activity to federal law enforcement by filing suspicious activity reports. The Federal Reserve is empowered to assess civil money penalties against financial institutions that engage in unsafe or unsound practices, which include failing to comply with the BSA.

While initial fraud investigations and prosecutions focused on individuals and companies that received pandemic relief, federal regulatory agencies are now scrutinizing financial institutions that distributed relief funds.

Enforcement Efforts to Date

The U.S. Department of Justice and numerous federal agencies have been actively investigating and, where appropriate, prosecuting pandemic fraud since the early days of the COVID-19 health crisis. Those efforts have almost exclusively focused on the recipients of pandemic-related assistance.

To date, the Justice Department has filed criminal charges against more than 1,500 defendants with alleged losses of over $1.1 billion and is conducting civil investigations of over 1,800 individuals and entities in connection with pandemic relief loans in excess of $6 billion.

In contrast, the government appears to have devoted little effort to investigating the role that lenders may have played in approving and processing fraudulent loan requests. To date, the Justice Department has announced only a single resolution with a financial institution for pandemic-related fraud.

In September 2022, the Justice Department announced a civil settlement with Prosperity Bank, a community bank with branches in Texas and Oklahoma. Prosperity Bank was accused of processing a PPP loan for an ineligible borrower and agreed to pay approximately $19,000 to settle allegations arising under the federal False Claims Act.

This was the first ever False Claims Act settlement with a financial institution for COVID-19 fraud. And despite the House Select Subcommittee on the Coronavirus Crisis releasing a lengthy report in December 2022 blaming nonbank financial technology companies for processing millions of dollars of fraudulent PPP loans, the government has yet to announce any resolution with a fintech company.

Popular Bank Settlement

Popular Bank was one of thousands of financial institutions approved by the Small Business Administration to process PPP loans. In August 2020, Popular Bank processed and funded six PPP loans, totaling approximately $1.1 million, despite detecting that the loan applications contained significant indicia of potential fraud.

Popular Bank failed to report the potential fraud and instead funded these six loans. All six PPP loans were determined to be fraudulent, and Popular Bank suffered a loss with respect to each loan.

The Federal Reserve determined that Popular Bank violated its internal BSA protocols and engaged in unsafe or unsound banking practices by processing the six PPP loans in question. The Federal Reserve imposed a civil monetary penalty of $2.2 million, and Popular Bank agreed to the penalty without admitting or denying any of the Federal Reserve's allegations.

In its announcement of the settlement, the Federal Reserve notes that Popular Bank self-reported this issue to regulators, undertook substantial remediation related to its ineffective controls and procedures that resulted in the unsafe or unsound practices, and fully cooperated with the Federal Reserve's investigation.

These proactive steps may have helped Popular Bank avoid criminal prosecution for knowingly processing fraudulent PPP loans.

What Financial Institutions Can Expect Next

While pandemic fraud investigations to date have for the most part focused on recipients of relief funds, scrutiny of PPP lenders is expected to increase in the coming months. The Justice Department has so far been leading the way in this effort, using the False Claims Act as the primary vehicle to hold lenders responsible for approving and processing fraudulent PPP loans.

With the announcement of the civil settlement with Popular Bank, the Federal Reserve has signaled that federal banking regulators are joining the effort to combat pandemic fraud and are moving the focus of these investigations to lenders.

In addition to the Federal Reserve, other federal banking regulators include the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency.

With their broad power to designate bank conduct as "unsafe or unsound," these regulatory agencies can impose steep civil fines and industry bans and can even refer potentially criminal conduct to the Justice Department for investigation and prosecution.

Also expected to join this effort is the U.S. Department of the Treasury's Financial Crimes Enforcement Network, the federal government's leading anti-money laundering regulator, which so far has been silent with respect to the role of financial institutions in the pandemic fraud.

Financial institutions that were participating PPP lenders must therefore brace themselves for inquiries from their primary banking regulator and be prepared to respond to requests for information about their PPP loan protocols. And as the Popular Bank settlement demonstrates, financial institutions that are proactive about uncovering and self-reporting fraud to regulatory agencies can expect more favorable outcomes.

The Justice Department's newly announced voluntary self-disclosure policy offers an opportunity for financial institutions to be proactive and mitigate their potential civil and criminal exposure. Under the new voluntary self-disclosure policy, a financial institution that becomes aware of potential criminal misconduct can self-report the misconduct to the government.

If the institution reports the suspected misconduct before the wrongdoing becomes publicly known or is otherwise made known to the government, the government will resolve the case with a declination, nonprosecution agreement or deferred prosecution agreement.

The self-disclosure, however, must be voluntary and within a reasonable amount of time after the lender discovered the misconduct, and the disclosure must include all relevant facts. Even if the financial institution does not meet all the necessary criteria, a prompt self-disclosure will still be considered favorably by the government.

Reprinted with permission from Law360(c) 2023 Portfolio Media. Further duplication without permission is prohibited. All rights reserved.