While uncertainty has been the overarching theme of the global COVID-19 pandemic, one thing is beyond doubt: the Coronavirus Aid, Relief, and Economic Security (CARES) Act’s distribution of more than $2 trillion in stimulus funds is the precursor to a new wave of government enforcement actions once the dust settles. To avoid being ensnared in an investigation that may make you regret taking the government’s offer, companies should take shelter in lessons learned from the government’s crackdown following the 2008 Troubled Asset Relief Program (TARP).

When it comes to government stimulus packages, the adage “you don’t get something for nothing” rings true. Recent history has shown that with a company’s acceptance of government funds comes a heightened level of government scrutiny, not only into the company’s use of those funds, but also into the company’s business dealings as a whole. Just over a decade ago at the height of the financial crisis, the TARP stimulus pumped $700 billion into a struggling economy. With this $700 billion stimulus came more than a decade of criminal and regulatory enforcement actions resulting in hundreds of criminal convictions and billions of dollars of financial penalties. The CARES Act dwarfs the TARP stimulus in size and scope, and its resultant enforcement activity will inevitably outpace that of TARP.

Given this, what should companies applying for and receiving CARES Act funds expect and how can they best protect themselves?

Learning from the Past: Oversight Mechanisms

In October 2008, President George W. Bush signed TARP as a defensive measure against the country’s mortgage and financial crisis. TARP sought to “mend the financial situation of banks, strengthen overall market stability, improve the prospects of the U.S. auto industry and support foreclosure prevention programs.” [2] Congress authorized $700 billion for TARP [3] — a fraction of the amount the CARES Act authorizes.

To protect these funds from fraud, lawmakers gave TARP’s billions-dollar bailout a three-pronged oversight structure establishing (1) the Financial Stability Oversight Board (FSOB), (2) the Congressional Oversight Panel (COP), [4] and (3) a Special Inspector General (SIGTARP). [5] While TARP tasked the FSOB and COP with advising and monitoring the program, SIGTARP was the enforcement arm of the legislation.

Taking a page from the TARP playbook, the CARES Act provides for similar oversight through three regulatory bodies, which include (1) a Special Inspector General for Pandemic Recovery (SIGPR), (2) the Pandemic Response Accountability Committee, and (3) a Congressional Oversight Committee. [6] Similar to SIGTARP, SIGPR is tasked with auditing and investigating CARES Act loans and investments. [7]

On the heels of the CARES Act’s enactment, there are already indications that enforcement will be stringent. Merely with respect to the acceptance of CARES Act funds, Treasury Secretary Mnuchin stated during a White House Press Briefing that there would be “severe consequences” for small business loan recipients “who don’t attest properly” to the loan application’s certification that the funds are necessary to support the applicant’s ongoing operations. [8] Secretary Mnuchin further elaborated on these consequences in later remarks, expressly stating that borrowers will face “criminal liability if they made [a] certification and it’s not true.” [9] He also referenced the government’s intention to audit PPP loans, noting “[f]or any loan over $2 million, the SBA will be doing a full review of that loan before there is loan forgiveness.” [10] Certain recipients have already started returning CARES Act funds to avoid future scrutiny.

Enforcement under TARP

With government bailouts come enhanced scrutiny. After its creation in late 2008, SIGTARP hit the ground running. By September 2009, SIGTARP had opened 61 investigations; almost half of which were based in part on tips left on SIGTARP’s whistleblower hotlines. [11] To date, 438 individuals have been criminally charged following SIGTARP investigations, with 381 convicted and 300 of these defendants sentenced to prison. [12] SIGTARP investigations have also resulted in enforcement actions against 24 companies, overwhelmingly in the banking and financial services industry. [13] Enforcement continues to be robust more than a decade later. In 2019, the government recovered an additional $900 million from TARP offenders, bringing the total recovery to over $11 billion. [14]

What led to such vigorous enforcement actions and a corresponding massive recovery through fines and penalties? SIGTARP investigations have largely targeted three types of conduct: (1) outright fraud either in securing or using TARP funds, (2) fraud in general business dealings, and (3) false statements intended to hide the foregoing fraud. Fraud charges have included conspiracy to defraud the United States, bank fraud, wire fraud, accounting fraud, and mail fraud, as well as theft, embezzlement, and misappropriation of funds. Charges related to false statements—often intended as a means to hide fraud from shareholders or regulators—have included making false statements on loan or credit applications, conspiracy to make false statements, false securities filings, false books and records, and lying to regulators or auditors.

Counterintuitively, while SIGTARP investigated companies that took bailout funds, the targeted violations were often unrelated to use of the funds themselves. By accepting taxpayer money, businesses that had previously managed to hide prior or ongoing bad conduct were suddenly in the spotlight. From fraudulent loans [15] to faulty ignition switches, [16] SIGTARP uncovered conduct by both companies and individuals that was divorced from the use of bailout funds. This proves the adage that once you let the elephant into your tent, he’s going to look around for a while.

Of course, past mistakes were not the only bad acts that led to enforcement. Misuse of bailout funds also frequently resulted in enforcement actions. In some cases, these claims included using funds to plug fraudulently created gaps in accounting records, while in other instances, SIGTARP uncovered false claims related to business revenue made in order to secure TARP funds. [17] In addition to the common charges noted above, this type of conduct has led to charges under the False Claims Act and conspiracy to defraud the United States.

Early Signs of CARES Act Enforcement: Certifications

As revealed through Treasury Secretary Mnuchin’s White House Press Briefing statement, certifications will likely be one of the early areas of government enforcement. This is especially true of the Paycheck Protection Program (PPP) which has implications for both large and small businesses. The program is designed to assist small businesses with 500 employees or fewer, and the PPP loan application requires a “good faith certification” that the loan is needed and will be used for certain expenses, among other limitations. [18] Treasury Secretary Mnuchin has already foreshadowed consequences for larger businesses if such companies seek to borrow or use PPP funds. [19] He has offered a temporary grace period for companies who improperly borrowed PPP funds, noting, “[c]ertain people under PPP may not have been clear in understanding the certification, so we’re going to give people the benefit of the doubt. If you pay back the loan right away, you won’t have liability to the SBA and to Treasury.” [20] Such self-certifications are ripe for investigation if the government suspects misrepresentation during the application process.

Precautions Now Can Promote Long-Term Corporate Health [21]
With a bailout fund three times as large as TARP and counting, companies applying and receiving funds under the CARES Act should do so with caution and with the understanding that scrutiny may follow. The following are best practices companies should keep at the forefront of their minds in this next phase of the COVID-19 bailout:

• Be aware of the skeletons in the closet. Even before receiving CARES Act funds, businesses should know their history of compliance and any ongoing conduct that may create liability in the future. The need for financial relief now should be balanced against the risk a business may face in the future.

• Start off on the right foot. Despite the drove of applicants and the race to apply for funds, businesses should ensure their applications are complete and they have properly represented their financial standing. Seek appropriate counsel at all times to ensure you are complying with the letter and spirit of the law and accounting support where needed.

• Ensure oversight at the Board and senior management level. These are material matters that should involve the senior officers of the company in preparing, evaluating and reviewing the details of the application and certifications being submitted on behalf of a company. A company should ensure all major decisions are then presented by senior management to its board of directors for discussion and approved, including a careful review of certifications being made on behalf of the company. The board of directors should be actively engaged in overseeing this process, receiving formal written presentations and asking questions about the application and the accuracy of the certifications, not simply rubber-stamping the materials. While there is an urgency in the need to submit the application, any board materials for review, discussion and approval should be distributed with enough time for the board members to read the materials. Sending a large amount of material to board members by email a few minutes before a meeting may not allow them time for proper oversight.

• Keep an accurate and complete record. Maintain proper documentation of why your company applied for CARES Act funding, the support for the certifications it made and how funds are ultimately used. Importantly, companies should be prepared to answer questions about these decisions potentially years down the road. That means a company should ensure that any presentations to the board or a committee meeting as well as minutes of those meetings memorialize these discussions, especially as when the discussion related to a company’s basis for attesting to the certification. It also means that directors or other decision makers have access to complete information and the opportunity to test and verify the certifications being made. This includes any email correspondence related to the topic, which may be required to be produced in an audit, investigation or other proceeding. Adhering to a robust approval process and corresponding document preservation policy is critical when it is time for government or auditor review. If your company has a document retention policy, review the policy to ensure that the documentation will not be automatically destroyed on a set date, and if so, consult with your counsel on whether to suspend the policy for documents that relate to the PPP loan.

• Designate a point person. Businesses should consider tasking a specific employee or group with overseeing all documentation and information regarding CARES Act funds. This point person(s) will be responsible for collecting information relating to the CARES Act certification, seeking appropriate sign-off from the board of directors or senior management (or both), and documenting every step in the process. This point person should maintain a complete record of how stimulus funds are used in the event a later reconciliation is required. Finally, this point person should assume that questions will be asked down the road and document each step in the process accordingly.

• Consider setting up a separate bank account for PPP loan proceeds. In order to easily track the use of proceeds and tie them to the PPP loan, consider setting up a separate bank account to avoid any questions of intermingling of funds. This will also help create an audit-friendly documented trail of the use of proceeds, while making it easier for businesses to demonstrate forgivable spending derived from PPP loan funds. If your company does not open a separate account, be meticulous in documenting how, when, and why PPP funds are spent in order to avoid future investigative inquires and support your company’s claims for loan forgiveness.

• Remain vigilant. Once funds are disbursed, recipients should maintain strict oversight not just of the stimulus funds, but also of their business practices as a whole. Companies should certainly ensure the funds are used in compliance with the CARES Act, but they should also keep an eye on conduct elsewhere in the business for at least as long as they hold on to taxpayer funds. Consider having the point person provide a written weekly update to senior management and the Board on the use of proceeds and setting biweekly Board calls to discuss and review the proper use of proceeds and business practices as a whole. The government will certainly be watching too.

• Maximize your legal support. The situation is rapidly evolving on a day-to-day basis. Be sure your company stays up to date on changes to provisions of the bailout, supplemental legislation, and governmental guidance. Consult counsel early and often. Keep counsel, internal and external, informed of any questions regarding the use of bailout funds and keep accurate records of how bailout funds are used.

NOTES:

[1] This is the third installment in a series that delves into possible government enforcement related to the CARES Act and identifies best practices for companies in the wake of the nation’s largest emergency relief package. To learn more, please find the first and second installments here: http://www.klgates.com/covid-19-looming-false-claims-act-liability-for-paycheck-protection-program-loans-04-09-2020/ and https://www.natlawreview.com/article/covid-19-congressional-investigations-and-pandemic-relief-oversight-mechanisms.
[2] Troubled Asset Relief Program (TARP), THE HISTORY CHANNEL (last updated Apr. 3, 2020) https://www.history.com/topics/21st-century/troubled-asset-relief-program.
[3] Congress initially approved $700 billion for TARP, but this amount was later reduced to $475 billion by the Dodd-Frank Wall Street Reform and Consumer Protection Act. See The U.S. Department of the Treasury, TARP Program, https://www.treasury.gov/initiatives/financial-stability/TARP-Programs/Pages/default.aspx# (last updated Nov. 15, 2016).
[4] For a more in-depth look at Congressional oversight of the CARES Act see https://www.natlawreview.com/article/covid-19-congressional-investigations-and-pandemic-relief-oversight-mechanisms.
[5] Economic Emergency Stabilization Act, Pub. L. No. 82 110–343, §§ 104, 121, 125 (2008).
[6] Kyle Cheney, Pentagon Watchdog Tapped to Lead Committee Overseeing $2 Trillion Coronavirus Package, POLITICO (Mar. 30, 2020) https://www.politico.com/news/2020/03/30/pentagon-coronavirus-committee-155721.
[7] Statement by the President, The White House (Mar. 27, 2020) https://www.whitehouse.gov/briefings-statements/statement-by-the-president-38/.
[8] Graham Rapier, Treasury Secretary Warns There Will Be ‘Severe Consequences’ for Large Companies That Took Bailout Loans Intended for Small Businesses, BUSINESS INSIDER (Apr. 22, 2020) https://www.businessinsider.com/treasury-mnuchin-consequences-big-companies-taking-ppp-small-business-loans-2020-4.
[9] Paul Kiernan, Mnuchin Warns Big Companies Taking Small Business Aid May Be Criminally Liable, Wall Street Journal (Apr. 28, 2020) https://www.wsj.com/articles/mnuchin-warns-larger-companies-against-seeking-coronavirus-funds-meant-for-small-businesses-11588083665.
[10] Id. (emphasis added).
[11] OFFICE OF THE SPECIAL INSPECTOR GENERAL FOR THE TROUBLED ASSET RELIEF PROGRAM (SIGTARP), QUARTERLY REPORT TO CONGRESS (Oct. 21, 2009) https://info.publicintelligence.net/October2009_Quarterly_Report_to_Congress.pdf.
[12] Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP), SIGTARP Investigations by the Numbers, available at https://www.sigtarp.gov/Pages/Home.aspx (last accessed Apr. 24, 2020).
[13] Id.
[14] Id.; Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP), About Us, available at https://www.sigtarp.gov/Pages/aboutus.aspx (last accessed Apr. 24, 2020).
[15] In one of many examples of fraudulent loan related charges, SIGTARP investigated officers of a California bank after they received $8 million in TARP funds which they used to fill holes in their books caused by illegal lending and the use of straw borrowers on real estate projects. See Press Release, Former CEO and Chief Loan Officer of Failed Sonoma Valley Bank, and Borrower’s California Attorney, Sentenced to Multi-Year Prison Terms for Bank Fraud and Other Claims, Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP) (Aug. 3, 2018) https://www.sigtarp.gov/Press%20Releases/sonoma_valley_bank_sentencing_Press_Release.pdf.
[16] After receiving $50 billion from TARP, General Motors was charged with concealing a deadly safety defect in its ignition switch from 2012 through 2014. See Press Release, SigTarp Investigative Efforts Lead to Criminal Charges Against General Motors and Deferred Prosecution Agreement with $900 Million Financial Penalty, Office of the Special Inspector General for the Troubled Asset Relief Program (SIGTARP) (Sept. 17, 2015) https://www.sigtarp.gov/Press%20Releases/GM_Criminally_Charged_and_Pays_900_Million.pdf.
[17] OFFICE OF THE SPECIAL INSPECTOR GENERAL FOR THE TROUBLED ASSET RELIEF PROGRAM (SIGTARP), QUARTERLY REPORT TO CONGRESS (Apr. 20, 2009) https://www.sigtarp.gov/Quarterly%20Reports/April2010_Quarterly_Report_to_Congress.pdf.
[18] James J. Wawrzyn and Steven M. Szymanski, CARES Act Paycheck Protection Program, NAT’L. LAW REVIEW (Mar. 29, 2020) https://www.natlawreview.com/article/cares-act-paycheck-protection-program.
[19] Vazquez, supra note 6.
[20] Id.
[21] For the latest guidance on the CARES Act and how it might impact your company, please visit the K&L Gates COVID-19 Response page at: http://www.klgateshub.com/categorylisting/?series=Responding+to+COVID-19.