CARES Act Paycheck Protection Program: Anti-Money Laundering Considerations (As of 4/29/2020)

Home , Loan

CENTER for REGULATORY STRATEGY AMERICAS CARES Act Paycheck Protection Program: anti-money laundering considerations (as of 4/29/2020)

In the rush to get stimulus relief to small Beneficial ownership – existing and For new customers, the updated FAQs business owners and employees, the new customers revealed a difference between the Small Business Administration’s (SBA) information required for the PPP loan Paycheck Protection Program (PPP) created One goal of the CARES Act and PPP is to and the BSA/AML requirements, including challenges, some unforeseen, for the have loans originated and disbursed quickly, the 2018 Customer Due Diligence Rule government, financial institutions, and and, with the second injection, more widely Customer Due Diligence Requirements borrowers. To provide some clarity to distributed. The initial guidance from the for Financial Institutions (CDD Rule). A the unforeseen challenges, shortly after SBA’s Interim Final Rule indicated that lender should still follow its processes Congress signed the Coronavirus Aid, financial institutions did not need to verify for onboarding, collecting, and verifying Relief, and Economic Security (CARES) Act1 beneficial ownership information for existing due diligence information, and risk rating into law, the US Department of the Treasury, customers, though were less clear for new customers, that may extend beyond 7 SBA, and Financial Crimes Enforcement customer’s obligations. Lenders should the information provided in the PP loan Network (FinCEN) released additional evaluate both existing and new customers application and PPP loan due diligence. guidance for the PPP through the Interim to confirm that they properly address the Final Rule2, as well as the SBA’s3 and FinCEN’s new, complicated program guidelines and For both new and existing customers, Frequently Asked Questions (FAQS).4 requirements (e.g., eligibility and timely the SBA requires lenders to collect and disbursement) to manage the BSA/AML verify beneficial ownership “pursuant to In addition, the PPP received additional operational risk of the program. the lender’s risk based approach to BSA funding on April 24, 2020. With an additional compliance.” The SBA PPP requires that $310 billion dollars of funding allocated— For existing customers, lenders should lender’s collect information from natural nearly doubling the size of the program5— consider the PPP loan beneficial owner persons with more than a 20 percent or more lenders participating in the program information in relation to what it has more ownership stake. Lenders should will be impacted. With respect to Bank documented for the same customers in its follow their procedures and policies Secrecy Act/Anti-Money Laundering (BSA/ know your customer (KYC) system. On April for beneficial ownership information AML) programs these lenders (banks and 13, 2020, the SBA and FinCEN addressed or collecting new beneficial ownership non-banks alike) should consider how the a lender’s responsibilities with regards to information with a focus on high-risk PPP loan program intersects with their collecting beneficial ownership information. customers, regardless of the SBA or AML program requirements. In particular, For existing customers, there is no CDD thresholds. institutions should consider how a PPP requirement to re-verify information, unless loan might impact their AML programs’ as “required by the institution’s risk-based Authorized signers approach.” If lenders have not yet collected obligations with respect to collecting, According to the SBA, lenders may rely on beneficial ownership information on existing identifying, certifying, and risk assessing the representation of a single individual’s customers, there is no requirement to verify their customers’ information, especially in signature as an “authorized representative” this information before disbursement.8 the absence of additional guidance. of the applicant.10 However, the SBA notes This guidance for PPP loans is in line with that lenders should take appropriate steps For an overview of Deloitte’s initial view of FinCEN’s 2018 ruling that exempts covered to confirm that the authorized signer has the PPP loan considerations for financial institutions from re-verifying extensions and meets the requirements of the PPP services industry, please read here.6 of loans that do not require underwriting program. Further, BSA/AML Officers should 9 However, institutions review or approval. confirm that authorized signers exist within should evaluate if there are changes based the KYC file, and evaluate if there have on the PPP loan to KYC comparison. been changes in the ownership structure in period between the last time the KYC file was updated and the loan application. Risk rating Transaction monitoring considerations Conclusion As part of normal client on-boarding, the Through their guidance, regulators and • Should the institution run transaction CDD Rule requires financial institutions FinCEN appear to be balancing the necessity monitoring rules on the direction of the to conduct due diligence in order to of speed of disbursement with institutions’ payments – outgoing loan disbursements understand the nature and purpose of the BSA obligations. However, BSA/AML (e.g., large disbursements relative to the customer relationship. While the SBA and Officers should prepare for the operational expected loan durations of 2.5 months FinCEN have suggested that lenders are considerations of the in-progress guidance. or if the employee name on the payroll able to use previously collected beneficial In its April 3, 2020 notice to financial provided are not the individuals receiving information for existing customers, the institutions on complying with the BSA during loan proceeds)? guidance does not provide additional insight the COVID-19 pandemic, FinCEN stated that on how lenders should approach risk rating • Do new accounts only include it expects financial institutions to diligently“ customers with the PPP loan. Lenders loan proceeds? adhere to their BSA obligations” (emphasis should consider if the new loan or the new added).12 In a risk-based approach, it may be loan information (e.g., beneficial ownership • Are there any additional risk factors such wise for a lender to perform its AML program and associated percentages) from the as monitoring for geographic location? obligations and responsibilities to loans existing customer is ingested or needs to the lender assumes after the funding and Does the institution have transaction be uploaded into the customer risk rating • forgiveness processes are complete. monitoring rules that would identify tool. BSA/AML Officers and their staff similar minority owners or employees should consider operational processes (e.g., This is part of a series of insights from on PPP loans? additional due diligence or enhanced due the Center for Regulatory Strategy on diligence) for risk rating changes to existing the implications of the CARES Act on the • Should institutions consider PPP loans customers and generate a risk rating for financial services industry. We–like you–are sold in the secondary market as new customers. closely monitoring any developments that transferable securities? will emerge after the enactment of the law, Immediate-term questions for BSA/AML including interpretive guidance from both Longer-term considerations: officer to consider: the SBA and FinCEN on requirements for • Lenders exhausted the first tranche of lenders. Please visit our CARES Act summary KYC considerations PPP funding—nearly $350 billion—within page here for more information on the two weeks. Due to demand, financial • What is a reasonable timeframe to begin the impact to the financial services industry. institutions expect the second tranche to risk assessment and verification of existing go even more quickly. Are AML compliance and new customers’ beneficial ownership programs adequately staffed for future information after loan disbursement? rounds of PPP funding and the new • Does the lender’s CDD policy require customers that may accompany it? beneficial ownership or other re- Whereas the SBA has stated it will verification of customer information • hold harmless any lender that relies provided on the PPP loan with a focus on borrower’s documentation for on high-risk customers? loan forgiveness11, should the lender • What are the lender’s obligations if an proactively collect documentation for individual is a beneficial owner of 20 the customer as it would normally for percent on multiple companies, given loans the lender assumes and were not that the SBA’s guidance limits loans to forgiven (or only partially forgiven)? one customer? Do the multiple appearances make sense given what is known about the customer? Contacts Deloitte Center for Regulatory Strategy

Clint Stinger Irena Gecas-McCarthy Principal FSI Director, Deloitte Center for Regulatory Strategy, Americas Deloitte Risk & Financial Advisory Principal Deloitte Transactions and Business Analytics LLP Deloitte Risk & Financial Advisory Deloitte & Touche LLP Josh Hanna Principal Austin Tuell Deloitte Risk & Financial Advisory Manager Deloitte Transactions and Business Analytics LLP Deloitte Risk & Financial Advisory Deloitte & Touche LLP

Kyle Cooke Senior Consultant Deloitte Risk & Financial Advisory Deloitte & Touche LLP

1 US House of Representatives, “Coronavirus Aid, Relief, and Economic Security (CARES) Act,” accessed April 22, 2020. 2. Small Business Administration (SBA), “Business Loan Program Temporary Changes; Paycheck Protection Program,” accessed April 22, 2020. 3. SBA, “Paycheck Protection Program Loans Frequently Asked Questions (FAQs),” accessed April 22, 2020. 4. Financial Crimes Enforcement Network (FinCEN), “Paycheck Protection Program Frequently Asked Questions (FAQs),” accessed April 22, 2020. 5. SBA, “Paycheck Protection Program (PPP) Report”; accessed April 22, 2020; As of April 16, 2020, when the first tranche of funding for the program was exhausted, 4975 lenders had approved 1.66 million loans totaling $342.3 billion dollars. 6. Deloitte, “The CARES Act’s Paycheck Protection Program: Impact on financial services (as of 4/10/2020),” accessed April 22, 2020. 7. SBA, “Business Loan Program Temporary Changes; Paycheck Protection Program,” accessed April 22, 2020. 8. Financial Crimes Enforcement Network (FinCEN), “Paycheck Protection Program Frequently Asked Questions (FAQs),” accessed April 22, 2020. 9. FinCEN, “The Financial Crimes Enforcement Network Provides Further Information to Financial Institutions in Response to the Coronavirus Disease 2019 (COVID-19) Pandemic,” accessed April 22, 2020. 10. SBA, “Paycheck Protection Program Loans Frequently Asked Questions (FAQs),” accessed April 22, 2020; Question 11. 11. SBA “Business Loan Program Temporary Changes; Paycheck Protection Program,” accessed April 22, 2020. 12. FinCEN, “The Financial Crimes Enforcement Network Provides Further Information to Financial Institutions in Response to the Coronavirus Disease 2019 (COVID-19) Pandemic,” accessed April 22, 2020.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte shall not be responsible for any loss sustained by any person who relies on this publication

About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.