FORGIVE BUT DON'T FORGET - How to Mitigate Risk and Promote Fairness while Implementing the Paycheck Protection Program - Oliver Wyman
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
FORGIVE BUT DON’T FORGET How to Mitigate Risk and Promote Fairness while Implementing the Paycheck Protection Program Vivian Merker Tammi Ling Daniel Tannebaum Allen Meyer Aron Cohen Jake Ritchken
Forgive but don’t forget
COVID-19 has taken an enormous human and economic toll on the world, and financial
institutions globally are helping to implement government programs that have been designed
to mitigate economic damage. In the United States, financial institutions have been rushing to
implement the Paycheck Protection Program (PPP), a key provision within the Coronavirus Aid,
Relief, and Economic Security (CARES Act), which provides fully guaranteed (and forgivable) loans
to small businesses.
Lenders’ experiences from the global financial crisis should serve as a warning that good
intentions are not enough, and the impact of any infractions can be expensive and long-lasting.
Already, lenders are being accused of unfair practices in processing Paycheck Protection Program
(PPP) loan applications and face a variety of risks:
• Lawsuits have been filed against the largest banks in the country, accusing them of
prioritizing loans to larger businesses and existing lending clients.
• Lenders are processing loans differently from each other as well as changing their own
practices repeatedly, partially driven by changes from the Treasury and Small Business
Administration (SBA) — for example, one lender updated its application at least eight times in
the first 12 days of the program.
With the second tranche of Paycheck Protection Program funding approved by Congress, the
time for lenders to act is now to improve processing, minimize additional risk, and change public
perception. The focus must include both refinements to new loan origination and front-running
potential issues in loan forgiveness, servicing, and ultimately guarantee redemption.
Exhibit 1. Sources of risk across the Paycheck Protection Program life cycle
~2 year program life cycle:
Today
Rolling 8 weeks Rolling 6 months End of 2-year
April - June 2020 after origination after origination program
Origination Forgiveness Return to Guarantee Ongoing
period period regular redemption investigations
servicing period /enforcement
Key • “Unfair” loan • “Unfair” loan • Inaccurate • Insufficient • Inadequate
sources application forgiveness calculation of records for evidence of
of risk processing processing loan payments guarantee effective
redemption policies and
• Operational • Operational • Operational controls
error from error from error from • Errors or
originating reviewing large number information • Failure to
large number large number of delinquent uncovered maintain
of loans of loans loans that negate robust records
guarantees on all loans
• Failure to • Failure to • Failure to
meet Bank meet due follow SBA • Failure to
Secrecy Act diligence requirements conduct
requirements requirements for delinquent adequate
on forgiveness loans recovery of
documents/ assets post
certification default
Throughout: • Poor communication with customers
• Failure to adapt to evolving Treasury and SBA requirements
Source: Oliver Wyman analysis
© Oliver Wyman 2Forgive but don’t forget
To address these risks, we recommend setting up a cross-functional “Control Tower,” which
establishes the control framework and monitors key metrics to oversee the remainder of the
Paycheck Protection Program, including:
• Establishing well-controlled and documented processes, in alignment with compliance
best practices.
• Providing clear communication with clients.
• Maintaining controls, quality assurance, and second-line testing to better understand and
mitigate risks.
• Leveraging technology for optimal processing, data collection, and demonstrating clear
audit trails.
While the Paycheck Protection Program lending period expires June 30, 2020, and the funds may
run out sooner, the pitfalls lenders face could lead to consequences for years to come.
© Oliver Wyman 3Forgive but don’t forget
AMBIGUITY IN THE DEFINITION
OF FAIRNESS
FAIRNESS IN “FIRST-COME, FIRST-SERVED”
AT ORIGINATION
Fairness already figures prominently in both the lawsuits lodged against banks and the media
reports on roll out of the Paycheck Protection Program. The SBA interim final rule states that
the Paycheck Protection Program is “first-come, first-served,” and SBA guidance clarifies that
the SBA will process applications in the order they are received. However, the definition of
“first-come, first-served” is not straightforward for lenders. Processing times will differ by
institution. Furthermore, within lenders, processing time depends on application channel,
geography, and the business unit in the lender responsible for the customer, among other
factors. Beyond managing reputational risk and doing what is right, fair lending and other
applicable laws still apply.
Lenders need to consider how borrowers are prioritized, navigating potential pitfalls before
they arise:
• Prioritizing borrowers by size: Neither the CARES Act nor SBA guidance require that
lenders have the same processes for all customers, and such a requirement would be very
difficult to meet. Larger businesses are more likely to have dedicated relationship managers
and support, making it easier to contact lenders and formally “submit” an application.
Smaller businesses are less likely to have application documentation readily available. Prior
Oliver Wyman research shows that only 30 percent of small businesses have loans aside from
credit cards, meaning they are likely to require guidance on loan processes.
• Prioritizing borrowers with existing relationships: The CARES Act requires that all lending
institutions maintain compliance with the Bank Secrecy Act (BSA), the US anti-money
laundering (AML) law, meaning that lenders are subject to existing “Know Your Customer”
(KYC) requirements, which can be time consuming. Unlike other areas where regulations have
been eased, BSA requirements are static, limiting flexibility to lenders to speed their client
onboarding process. Therefore, most lenders have elected to only serve existing customers.
• Prioritizing borrowers with outstanding first wave applications: While the initial
allocation of $349 billion for the Paycheck Protection Program was exhausted within two
weeks of launch, Congress recently approved an additional $310 billion of funding. Lenders
must consider how they treat loan applications that did not receive funding in the first wave,
particularly in the cases of incomplete applications.
With the possibility of additional future funding tranches, the issues related to loan application,
including in which customers are served, how, and in what order, will likely continue.
© Oliver Wyman 4Forgive but don’t forget
Exhibit 2. Larger loans accounted for a disproportionate share of the first round of
PPP funding
Allocation of the first wave funding prioritized larger businesses; the largest 2 percent of small
businesses received 26 percent of loans given.
Share of potentially 98% 2%
eligible businesses
Share of loans in first
74% 26%
round of funding
Firms eligible for loans of $150K or less Firms eligible for loans
(roughly equivalent to under 20 employees, on average) of more than $150K
(roughly equivalent to
20 or more employees
on average)
Note: Includes independent contractors and self-employed individuals who became eligible one week into the Paycheck
Protection Program
Source: Data from SBA, IRS, and US Census Bureau. Oliver Wyman analysis.
FAIRNESS WHEN CONDUCTING DUE DILIGENCE
FOR FORGIVENESS
Federal guidance on conducting application due diligence has largely deferred policy to
lenders, allowing lenders to decide on their own and leaving questions of fairness to trickle
down to lenders’ internal procedures. For the Paycheck Protection Program, loans are subject
to full forgiveness if used for eligible expenses during the eight weeks after disbursement,
which include payroll costs and some rent or mortgage payments1, provided borrowers supply
documentation demonstrating appropriate use of funds.
SBA guidance indicates that lenders do not need to confirm the accuracy of documents provided
and can rely on borrower certification that funds were used as intended, similar to the reliance
on borrower certification for loan eligibility. However, the CARES Act still requires the provision
of documentation, leaving lenders with ambiguity and open questions on what verification
processes are required, and allowable.
Basic verification may protect against future accusations of facilitating fraud. Given that typical
documentation standards may offer advantage to larger businesses who are more likely to have
support from payroll providers, accountants, and other professionals, lenders need to balance
appropriately permissive documentation requirements with the protections against fraud in
processing smaller business loan forgiveness applications.
1 From the SBA interim final rule: The actual amount of loan forgiveness is dependent on the amount spent by borrower on the
following eligible items: payroll costs — up to $100,000 of annualized pay per employee for eight weeks (as well as benefits,
health care expenses, retirement contributions and state taxes on employee payroll imposed by employer), eight weeks of
business owner compensation replacement, payments of interest on mortgage obligations on real or personal property
incurred before February 15, 2020, rent payments or lease agreements in force before February 15, 2020, and utility payments
under service agreements dated before February 15, 2020. 75 percent of the loan amount forgiven must be related to
payroll costs.
© Oliver Wyman 5Forgive but don’t forget
RECOMMENDATIONS TO
IMPLEMENT IMMEDIATELY
The primary focus of lenders so far has been on the origination period and getting borrowers’
loans processed and funded through the SBA. Lenders need to establish and maintain
appropriate operational processes and controls throughout the loan’s life cycle. The following
recommendations are intended to help lenders implement the Paycheck Protection Program
with robust and fair processes.
ESTABLISH A “CONTROL TOWER” RESPONSE TEAM
Lenders should establish a “Control Tower” — a cross-functional central team with accountability
to make decisions and manage issues. The “Control Tower” should be comprised of key senior
executives from Business, Risk, Operations, Technology, Corporate Communications/Marketing,
Legal, and Compliance/Anti-Financial Crime that are responsible for:
• Designing and overseeing implementation of revised processes: Changes to policies and
procedures, communication with clients, quality assurance and controls, and technology and
operations are all required.
• Staying on top of evolving Treasury and SBA requirements: Program updates can come at
any time and often require rapid procedure changes, new documentation, and staff training.
• Monitoring key performance and risk indicators (KPI/KRIs) across the life cycle:
Real-time updates are required for key KPIs/KRIs across operations and compliance, including
processing times, approval rates, forgiveness rates, and loan performance — segmented
by key variables such as geography, loan size, company size, client segment. Viewing and
tracking these metrics provides insight into potential skews with regard to fairness and avoids
costly mistakes.
• Tracking customer feedback and complaints: Customer complaints can help identify flaws
with the program design, and issues which need to be addressed quickly. Customer focus
groups can also provide real-time feedback that enables lenders to address costly sources of
potential confusion.
• Providing a holistic view to senior management and the board: It is critical to provide
regular updates as well as escalate material risks and issues.
© Oliver Wyman 6Forgive but don’t forget
PROVIDE CLEAR COMMUNICATION
Perceptions of fairness can be damaged by poor communications. Having a clear external
communication strategy, both to the general public and to specific applicants/borrowers, can
mitigate these concerns and develop closer customer ties. An external communication strategy
should be:
• Standardized and systematic across borrowers to ensure efficiency and fairness.
• Transparent on the status of applications for loans and for forgiveness, including rationale
for individual lending decisions.
• Proactive to provide borrowers with relevant information regarding their loan and the overall
program and provide clarity on implementation of Paycheck Protection Program policies.
This is especially important to help borrowers prepare for forgiveness requirements by
documenting eligible spend.
• Accurate and consistent with guidance provided by the SBA and the Treasury, as well as other
relevant regulations, to avoid Unfair, Deceptive or Abusive Acts or Practices (UDAP) claims.
RUN WELL-DEFINED AND DOCUMENTED PROCESSES
Lenders have already come under scrutiny on how the initial Paycheck Protection Program loans
were processed and prioritized. Clear processes supported by policies and procedures are vital
for the remainder of the loan life cycle including loan forgiveness as well as servicing, default,
disposition, and recoveries. Internal policies, procedures, and other documentation needs
to include:
• Treatment of ambiguous requirements and situations: Lenders must capture how they
are interpreting “first-come, first-served,” incomplete applications, and other grey areas to
establish and adhere to a fair precedent.
• Instructions for documentation treatment: Lenders must be specific about the
documentation they require from borrowers (for example, can lenders rely on mostly
handwritten documentation). They also need to be clear internally about the verification
checks they are performing (for example, consistency checks with known information about
the customer from internal data and external sources when available). Challenges may arise
if the borrower provides information which conflicts with information the lender already has
on file, and whether the lender may be considered liable for knowingly transmitting false
information to the SBA.
• Service-level agreements (SLAs): Across the loan life cycle, lenders must establish
service-level agreements. This is especially critical for client touch points. Operations at
lenders are extremely strained, but without SLAs and monitoring by segment, lenders may
not understand the disparate impact resulting from their resource constraints.
• Standards for selling originated Paycheck Protection Program loans on the secondary
market: To expedite the distribution of funds, the SBA has loosened due diligence
requirements that lenders must perform on borrower eligibility. In cases where the lender
plans to sell loans on the secondary market, lenders should understand where additional due
diligence may be required to mitigate risk arising from the resale process.
© Oliver Wyman 7Forgive but don’t forget
MAINTAIN EXISTING (HIGH) STANDARDS FOR KYC/AML
The Paycheck Protection Program cannot be a fair program if funds are going to ineligible or
entirely fake businesses. Many lenders have made the decision to extend Paycheck Protection
Program loans only to existing customers in the first tranche of funding, but pressure to serve
non-customers with additional funding is coming from Congress and the public. While it may
be tempting to create new and “exception” processes in order to expedite decision-making, it is
critical to maintain high standards for customer due diligence (CDD) and transaction monitoring
(TM). Lenders cannot bypass due diligence procedures and must file Suspicious Activity Reports
(SARs) where fraud is suspected, and all surge resources involved in processing applications must
receive adequate training on applicable requirements. Further, should Congress ease certain
AML requirements, such as the elements of beneficial ownership or controller capture, a safe
harbor would need to be invoked as well, ensuring that lenders don’t fear process criticism in
subsequent regulatory obligations.
STRENGTHEN QUALITY ASSURANCE AND CONTROLS
A strong control framework and quality assurance (QA) program ensures that standards are
consistently applied across borrowers. This is especially important given the tight timelines
and operational constraints from the large volume of loans which are further exacerbated by
social distancing.
Lenders should consider further strengthening their program to include:
• Independent reviews: Leading lenders are commissioning independent reviews of their
origination practices during the first round of the Paycheck Protection Program funding.
These reviews allow lenders to self-identify potential fairness issues for their senior
management and board in addition to responding to pressure from Congress and the public
to explain their processes.
• “Real-time” secondary quality assurance checks for specific key processes: Implementing
additional checks on key aspects of certain processes, particularly for manual processes and
in the codification of documentation.
• Post-closing quality assurance checks against eligibility and compliance requirements:
Conducting checks to ensure borrower documentation aligns with application information.
Where possible, compare applicant information to recent lender records to identify potential
conflicting information, to reduce operational risk and to uncover potential customer fraud.
• Additional reviews looking holistically across the loan life cycle: Assessing against
principles of fairness by looking at the full portfolio of decisions made.
© Oliver Wyman 8Forgive but don’t forget
LEVERAGE TECHNOLOGY TO PROMOTE
OPERATIONAL CONSISTENCY
Lenders can increase the fairness of their processes by avoiding mistakes and running
operationally excellent processes assisted by technology. Best practices include:
• Rapidly automate any manual processes: Manual processes are error prone and can
lead to operational challenges. Automating processes, even for a one-time program, can
be invaluable to lenders. For example, the calculation of loan payments for un-forgiven
portions of Paycheck Protection Program loans will require accurate accounting for new
loan specifications.
• Maintain strong document management systems and an audit trail: Beyond ensuring
that the loan software maintains a clear audit trail and tracks necessary metadata, document
management systems are necessary, both to recall the long-form documents (for example,
payroll information) and to codify unique key numbers (such as number of employees for
payroll). Lenders should institute a post-closing process for loans to ensure that records are
cleanly submitted and available for recall as it is possible that the SBA and regulators may ask
for dated records.
• Integrate with data sources: To expedite forgiveness processes, lenders should establish
API connections with payroll providers and other information sources. Aligned with its
internal verification processes, lenders should consider whether to cross reference forgivable
spend against DDA records when lenders have the businesses’ primary transaction accounts.
• Prepare for large volumes of collections and delinquencies: Operationally, lenders will
need to have resources lined up to service potentially large waves of delinquent loans. This
may include using new technology to communicate with borrowers, all in adherence to SBA
and other regulatory requirements. In addition, appropriate protocol for the recovery of
assets post-default will be critical in maintaining the SBA guarantee.
© Oliver Wyman 9Forgive but don’t forget
CONCLUSION
While the first round of the Paycheck Protection Program funding has been exhausted, lenders
have an opportunity to identify prior shortfalls, continuously improve origination in subsequent
round(s) of funding, and plan ahead for forgiveness, servicing, and loan disposition.
Exhibit 3. Key activities across the Payment Protection Program life cycle
~2 year program life cycle:
Today
Rolling 8 weeks Rolling 6 months End of 2-year
April - June after origination after origination program
Origination Forgiveness Return to Guarantee Ongoing
period period regular redemption investigations
servicing period /enforcement
Key
“Control Tower” to establish the control framework and monitor key metrics to oversee the PPP
activities
• Independently • Develop • Prepare for • Plan for • Prepare clear
review initial scalable significant guarantee ongoing
approach approach to volume of redemption, documentation
perform all delinquent preparing and evidence of
• Continue to necessary due loans to service necessary proper treatment
improve diligence on documentation per policy
processes borrower and evidence
documentation • Maintain robust
• Document • Prepare for records on all
procedures, recovery of loans
standards, and assets post
precedents default
Throughout: • Plan communication with customers
• React to changes to evolving Treasury and SBA requirements
Source: Oliver Wyman analysis
Already we are seeing lenders experience reputational damage from their approach to the
Paycheck Protection Program. The risks that are present in the remainder of the Paycheck
Protection Program will require executive attention, institutional resources, and careful
management. The time to act is now.
© Oliver Wyman 10Oliver Wyman is a global leader in management consulting that combines deep industry knowledge with specialized expertise in strategy, operations, risk management, and organization transformation. For more information, please contact the marketing department by phone at one of the following locations: Americas EMEA Asia Pacific +1 212 541 8100 +44 20 7333 8333 +65 6510 9700 AUTHORS Vivian Merker Allen Meyer Partner, Financial Services Partner and Americas Compliance Practice Head vivian.merker@oliverwyman.com allen.meyer@oliverwyman.com Tammi Ling Aron Cohen Partner, Financial Services Principal, Financial Services tammi.ling@oliverwyman.com aron.cohen@oliverwyman.com Daniel Tannebaum Jake Ritchken Partner and Americas Anti-Financial Crime Head Engagement Manager, Financial Services daniel.tannebaum@oliverwyman.com jake.ritchken@oliverwyman.com Copyright © 2020 Oliver Wyman All rights reserved. This report may not be reproduced or redistributed, in whole or in part, without the written permission of Oliver Wyman and Oliver Wyman accepts no liability whatsoever for the actions of third parties in this respect. The information and opinions in this report were prepared by Oliver Wyman. This report is not investment advice and should not be relied on for such advice or as a substitute for consultation with professional accountants, tax, legal or financial advisors. Oliver Wyman has made every effort to use reliable, up-to-date and comprehensive information and analysis, but all information is provided without warranty of any kind, express or implied. Oliver Wyman disclaims any responsibility to update the information or conclusions in this report. Oliver Wyman accepts no liability for any loss arising from any action taken or refrained from as a result of information contained in this report or any reports or sources of information referred to herein, or for any consequential, special or similar damages even if advised of the possibility of such damages. The report is not an offer to buy or sell securities or a solicitation of an offer to buy or sell securities. This report may not be sold without the written consent of Oliver Wyman. Marsh & McLennan Company www.mmc.com
You can also read
