2024-18083. Business Loan Program Temporary Changes; Paycheck Protection Program-Extension of Lender Records Retention Requirements

Document Headings

Document headings vary by document type but may contain the following:

1. the agency or agencies that issued and signed a document
2. the number of the CFR title and the number of each part the document amends, proposes to amend, or is directly related to
3. the agency docket number / agency internal file number
4. the RIN which identifies each regulatory action listed in the Unified Agenda of Federal Regulatory and Deregulatory Actions

See the Document Drafting Handbook for more details.

Small Business Administration

1. 13 CFR Part 120
2. [Docket Number SBA-2024-0006]
3. RIN 3245-AI17

AGENCY:

U.S. Small Business Administration.

ACTION:

Interim final rule.

SUMMARY:

This interim final rule lengthens the required records retention for lenders that made loans under the Paycheck Protection Program (PPP) to ten years. PPP was established under the Coronavirus Aid, Relief, and Economic Security Act as a temporary emergency guaranteed loan program to provide economic relief to small businesses nationwide adversely impacted by the Coronavirus Disease 2019 (COVID-19), as amended. SBA has issued a number of final rules implementing the PPP Program. This interim final rule harmonizes the PPP lender records retention requirements with subsequent legislation extending the statute of limitations for criminal charges and civil enforcement actions for alleged PPP borrower fraud to ten years after the offense.

DATES:

Effective date: The provisions of this interim final rule are effective August 22, 2024.

Applicability date: This interim final rule applies to all PPP lender loan records. This includes PPP loan applications that were withdrawn, approved, denied or cancelled, and all other PPP lender loan records for PPP loans with an outstanding balance, PPP loans that have been forgiven, and PPP loans that are in repayment or have been paid in full by the borrower as of the effective date of this rule.^[1]

Comment date: Comments must be received on or before September 23, 2024.

ADDRESSES:

You may submit comments, identified by docket number SBA-2024-0006 through the Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. ( print page 68091)

SBA will post all comments on www.regulations.gov. If you wish to submit confidential business information (CBI) as defined in the User Notice at www.regulations.gov, please send an email to [e-mail]. All other comments must be submitted through the Federal eRulemaking Portal described above. Highlight the information that you consider to be CBI and explain why you believe SBA should hold this information as confidential. SBA will review the information and make the final determination whether it will publish the information.

FOR FURTHER INFORMATION CONTACT:

A Call Center Representative at 833-572-0502 or the local SBA Field Office; the list of offices can be found at https://www.sba.gov/​tools/​local-assistance/​districtoffices. If you use a telecommunications device for the deaf (TDD) or a text telephone (TTY), call the Federal Relay Service (FRS), toll free, at 1-800-877-8339. Individuals with disabilities can obtain this document in an accessible format that may be provided in Rich Text Format (RTF) or text format (txt), a thumb drive, an mp3 file, Braille, large print, audiotape, or compact disc, or other accessible formats.

SUPPLEMENTARY INFORMATION:

I. Background Information

On March 27, 2020, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) (Pub. L. 116-136) was enacted to provide emergency assistance and health care response for individuals, families, and businesses affected by the Coronavirus Disease 2019 (COVID-19) pandemic. Section 1102 of the CARES Act temporarily permitted the Small Business Administration (SBA) to guarantee 100 percent of 7(a) loans made by participating lenders under a new program titled the “Paycheck Protection Program” (PPP), pursuant to section 7(a)(36) of the Small Business Act (15 U.S.C. 636(a)(36)) (First Draw PPP Loans). Section 1102(F)(ii)(I) of the CARES Act stated that all PPP lenders were deemed to have been delegated authority by the SBA Administrator to make and approve PPP loans (15 U.S.C. 636(a)(36)(F)(ii)(I)). Section 1106 of the CARES Act provided for forgiveness of up to the full principal amount of qualifying loans guaranteed under the PPP. On April 24, 2020, the Paycheck Protection Program and Health Care Enhancement Act (Pub. L. 116-139) was enacted, which provided additional funding and authority for the PPP Program.

On June 5, the Paycheck Protection Program Flexibility Act of 2020 (PPP Flexibility Act) (Pub. L. 116-142) was enacted, which changed provisions of the PPP relating to the maturity of PPP loans, the deferral of PPP loan payments, and the forgiveness of PPP loans. On July 4, 2020, Public Law 116-147 extended SBA's authority to guarantee PPP loans to August 8, 2020.

On December 27, 2020, the Economic Aid to Hard-Hit Small Businesses, Nonprofits and Venues Act (Economic Aid Act) (Pub. L. 116-260) was enacted. The Economic Aid Act reauthorized lending under the PPP through March 31, 2021. The Economic Aid Act added a new temporary section 7(a)(37) to the Small Business Act, which authorized SBA to guarantee additional PPP loans (Second Draw PPP Loans) to certain eligible borrowers that previously received a First Draw PPP Loan under generally the same terms and conditions available under section 7(a)(36) of the Small Business Act. The Economic Aid Act also redesignated section 1106 of the CARES Act as section 7A of the Small Business Act, to appear after section 7 of the Small Business Act.

On March 11, 2021, the American Rescue Plan Act (ARPA) (Pub. L. 117-2) was enacted, and among other things, expanded eligibility for First Draw PPP Loans and Second Draw PPP Loans. On March 30, 2021, the PPP Extension Act of 2021 (Pub. L. 117-6) was enacted, extending SBA's PPP program authority through June 30, 2021.

From April 3, 2020, through August 8, 2020, when the 2020 round of PPP expired, SBA guaranteed over 5.2 million PPP loans made by over 5,000 PPP lenders under delegated authority. Of the approximately 5,000 lenders that participated in the PPP Program, approximately 4,900 were federally regulated lenders and several hundred were SBA Supervised Lenders (as defined in 13 CFR 120.10). From January 11, 2021, when the PPP reopened, through June 30, 2021, when the PPP program authority expired, SBA guaranteed over 6.6 million additional PPP loans made by PPP lenders under delegated authority. Thus, the total number of PPP loans guaranteed by SBA exceeds 11.8 million.^[2] The total dollar amount of the PPP loans guaranteed by SBA exceeds $806 billion.

Because the approximately 5,000 PPP lenders processed PPP loans under the delegated authority provided by the CARES Act, the PPP lenders were responsible for obtaining loan applications and supporting documentation and preparing the loan note and other closing documentation. The PPP lenders were not required to provide SBA with copies of the loan origination and closing documentation, but instead when the PPP lenders applied to SBA for the issuance of a PPP loan number, the PPP lenders were required to certify that they would retain those documents in their files. See, SBA Form 2484 (Lender's Application—Paycheck Protection Program Loan Guaranty) and SBA Form 2484-SD (Lender's Application—Second Draw Loan Guaranty). The forms did not specify the length of time required to retain documents in their files.

SBA posted the first interim final rule implementing the PPP on SBA's website on April 2, 2020, and published the rule in the Federal Register on April 15, 2020 (85 FR 20811). SBA subsequently issued numerous additional interim final rules. In particular, on February 5, 2021, SBA published an interim final rule implementing Economic Aid Act changes related to the forgiveness and review of PPP loans (86 FR 8283) (Consolidated Forgiveness and Loan Review IFR).

On August 5, 2022, President Biden signed the PPP and Bank Fraud Enforcement Harmonization Act of 2022 (Harmonization Act) (Pub. L. 117-166). The Harmonization Act amends section 7(a) of the Small Business Act to provide, for both First Draw PPP Loans and Second Draw PPP Loans, that notwithstanding any other provision of law, any criminal charge or civil enforcement action alleging that a borrower engaged in fraud with respect to a PPP loan guaranteed by SBA shall be filed not later than 10 years after the offense was committed. The Harmonization Act was necessitated by the unprecedented volume of PPP loans, law enforcement estimates of the amount of fraud associated with these loans, and the tremendous strain on law enforcement resources in dealing not only with PPP Program fraud, but fraud in the other COVID-19 pandemic assistance programs administered by SBA and other Federal agencies.^[3]

SBA, with support from the Department of Justice (DOJ) and SBA's Office of Inspector General (OIG), which ( print page 68092) are charged with investigating and prosecuting PPP fraud, is seeking to harmonize the records retention requirements applicable to PPP lenders by extending those requirements so that they are consistent with expanded statute of limitations in the Harmonization Act.

As of December 31, 2023, U.S. Attorneys' Offices had criminally charged approximately 3,500 defendants in 2,388 pandemic fraud related cases, of which approximately 2,005 defendants had pleaded guilty or been convicted at trial.^[4] The fraud loss associated with these completed cases is more than $1.2 billion. While not all of the cases were related to the PPP Program, a substantial number were, and the U.S. Attorneys' Offices have a similar number of investigations open that are yet to be charged. Further, more than $1.4 billion in seizures and forfeiture orders have been issued to recover stolen CARES Act funds.

To date, the DOJ Civil Frauds Division has opened more than 800 new investigations relating to potential civil fraud enforcement in connection with the PPP Program. These include investigations implicating more than 5,000 individuals and entities and billions of dollars in pandemic relief funds. To date, DOJ has obtained more than 450 civil settlements and judgments relating to the PPP Program, totaling more than $200 million. The number of civil fraud investigations relating to PPP borrowers has grown in volume every year since 2020, and DOJ believes that trend is likely to continue.

Extending the PPP lender records retention requirements will ensure that PPP loan records remain available to law enforcement while they continue to investigate and prosecute PPP fraud during the expanded ten-year statute of limitations period authorized by the Harmonization Act.

II. Current SBA Records Retention Requirements for PPP Lenders

The Consolidated Forgiveness and Loan Review IFR sets forth the current SBA records retention requirements for PPP lenders as follows:

Lenders must comply with applicable SBA requirements for records retention, which for federally regulated lenders means compliance with the requirements of their federal financial institution regulator and for SBA supervised lenders (as defined in 13 CFR 120.10 and including PPP lenders with authority under SBA Form 3507) means compliance with 13 CFR 120.461. (86 FR 8283, 8295). These records retention requirements apply to all PPP loan records, including First Draw PPP Loans and Second Draw PPP Loans.

The records retention requirements in 13 CFR 120.461 for SBA Supervised Lenders provide as follows:

• Other preservation of records. An SBA Supervised Lender must preserve for at least 6 years following final disposition of each individual SBA loan:

All applications for financing;

Lending, participation, and escrow agreements;

Financing instruments; and

○ All other documents and supporting material relating to such loans, including correspondence.

Id.

As noted previously, several hundred SBA Supervised Lenders participated in the PPP Program. An SBA Supervised Lender is defined in 13 CFR 120.10 as a 7(a) Lender that is either a Small Business Lending Company or a NFRL. A 7(a) Lender is defined in 13 CFR 120.10 as an institution that has executed a participation agreement with SBA under the guaranteed loan program.^[5] A Small Business Lending Company (SBLC) is defined in 13 CFR 120.10 as a non-depository lending institution that is SBA-licensed and is authorized by SBA to make loans pursuant to section 7(a) of the Small Business Act and loans to Intermediaries in SBA's Microloan program. An NFRL or Non-Federally Regulated Lender is defined in 13 CFR 120.10 as a business concern that is authorized by the SBA to make loans under section 7(a) and is subject to regulation by a state but whose lending activities are not regulated by a federal financial institution regulator. Many of the several hundred SBA Supervised Lenders that participated in the PPP Program did so under their existing SBA Form 750 (Loan Guaranty Agreement (Deferred Participation)) or SBA Form 750CA (Community Advantage Pilot Program Loan Guaranty Agreement (Deferred Participation)). Other SBA Supervised Lenders participated in PPP by signing an SBA Form 3507 (CARES Act Section 1102 Lender Agreement—Non-Bank and Non-Insured Depository Institution Lenders).^[6]

The overwhelming majority of lenders that participated in the PPP Program are not SBA Supervised Lenders. Instead, they are federally regulated lenders. The approximately 4,900 federally regulated lenders that participated in the PPP Program included those PPP lenders regulated by the Federal Deposit Insurance Corporation, the Federal Reserve, the Office of the Comptroller of the Currency, the National Credit Union Administration, and the Farm Credit Administration. Many of these federally regulated lenders participated in PPP under their existing SBA Form 750 (Loan Guaranty Agreement (Deferred Participation)). Other federally regulated lenders participated in PPP by signing an SBA Form 3506 (CARES Act Section 1102 Lender Agreement).

Under the Consolidated Forgiveness and Loan Review IFR, federally regulated lenders that participated in the PPP Program are currently required to retain their PPP loan records in accordance with the records retention requirements imposed by their federal financial institution regulator. SBA has determined that there do not appear to be any consistent or specific time requirements imposed by federal financial institution regulators that are applicable to PPP records retention as a whole. Instead, federally regulated PPP lenders may implement and follow general internal records retention policies that are acceptable to their regulators. It is likely that many of these general internal records retention policies allow for periodic destruction of certain records after a loan is paid in full, which for PPP would include payment in full through forgiveness or otherwise.^[7] SBA has been making forgiveness payments to lenders on PPP loans since late 2020, so there is considerable time sensitivity associated with the need to extend the current PPP records retention requirements for federally regulated lenders.

This interim final rule extends the records retention requirements for all PPP lenders to ten years from the date of final disposition of each individual PPP loan.

III. Interim Final Rule With Immediate Effective Date

This interim final rule is being issued without advance notice and public comment because section 1114 of the CARES Act and section 303 of the Economic Aid Act authorize SBA to issue regulations to implement the PPP Program without regard to notice requirements. Congress designed the PPP as a temporary emergency program, and the issuance of this interim final rule under the statutory rulemaking ( print page 68093) authority in the CARES Act and the Economic Aid Act is consistent with Congressional intent.

SBA finds good cause for forgoing the advance notice-and-public-comment procedure because that procedure would be impracticable. The earliest PPP loan was made in April 2020 and SBA began forgiving PPP loans in late 2020, so it is urgent that the PPP lender records retention requirements be extended to prevent the lapse of records retention requirements for and potential destruction of PPP records by federally regulated lenders that could result in the loss of records that need to be preserved for law enforcement purposes. As noted previously, the overwhelming majority of PPP lenders are federally regulated lenders. Under the Consolidated Forgiveness and Loan Review IFR, those approximately 4,900 lenders are currently required to follow the records retention requirements of their federal financial institution regulators. SBA has determined that there do not appear to be any consistent or specific time requirements imposed by federal financial institution regulators that are applicable to PPP records retention as a whole. Instead, federally regulated PPP lenders may implement and follow general internal records retention policies that are acceptable to their regulators. It is likely that many of these general internal records retention policies allow for periodic destruction of certain records after a loan is paid in full, which for PPP would include payment in full through forgiveness or otherwise. Since SBA began making forgiveness payments to PPP lenders starting in late 2020, it is urgent that the current PPP records retention requirements be extended to prevent the destruction of PPP loan records.

Additionally, advising PPP lenders of the extended records retention requirement expeditiously will allow those lenders to adjust their systems and processes as soon as possible in order to comply with the newly extended records retention period. If SBA were to follow the advance notice-and-public-comment process, that would delay issuance of the rule by at least three months, during which time records that need to be preserved for law enforcement purposes are at risk of loss.

For related reasons, SBA has determined that there is good cause to make this rule effective immediately. 5 U.S.C. 553(d)(3). An immediate effective date will prevent potential loss of records that need to be preserved for law enforcement purposes. Given the urgent need to preserve PPP loan records for law enforcement purposes, SBA has determined that it is impractical and not in the public interest to provide a delayed effective date. An immediate effective date will allow PPP lenders to adjust their systems and processes to prevent the loss of PPP loan records that need to be preserved for law enforcement purposes. In this rule, SBA is not imposing a new requirement on PPP lenders, rather SBA is extending an existing requirement of records retention. The systems and process that will need to be adjusted are those that prevent the periodic destruction of records, and SBA believes that PPP lenders do not need a delayed effective date to make these adjustments.

Although this interim final rule is effective immediately, comments are solicited from interested members of the public on all aspects of the interim final rule. These comments must be submitted on or before September 23, 2024. SBA will consider these comments and the need for making any revisions as a result of these comments.

IV. Revisions to Prior PPP Rule

To harmonize the PPP lender records retention requirements with the ten-year PPP fraud statute of limitations in the Harmonization Act, SBA is extending the records retention requirements for all PPP lenders to ten years from the date of final disposition of each individual PPP loan. The extended records retention requirements apply equally to federally regulated lenders (including lenders that executed an SBA Form 3506) and SBA Supervised Lenders (including lenders that executed an SBA Form 3507).

Therefore, the following change is made to the Consolidated Forgiveness and Loan Review IFR:

The last paragraph of Part V.1.c. of the Consolidated Forgiveness and Loan Review IFR (86 FR 8283, 8295) is revised to read as follows:

1. SBA Reviews of Individual PPP Loans

* * *

c. When will SBA undertake a loan review?

* * *

All PPP lenders must preserve for at least 10 years following final disposition of each individual PPP loan:

i. All applications for financing (including applications for withdrawn, approved, declined and cancelled loans);

ii. Lending, participation, and escrow agreements;

iii. Financing instruments; and

iv. All other documents and supporting material relating to such loans, including correspondence.

V. Additional Information

SBA may provide further guidance, if needed, through SBA notices that will be posted on SBA's website at www.sba.gov. Questions on the PPP Program may be directed to the Lender Relations Specialist in the local SBA Field Office. The local SBA Field Office may be found at https://www.sba.gov/​tools/​local-assistance/​districtoffices.

Compliance With Executive Orders 12866, 12988, 13132 and 13563, the Congressional Review Act, the Administrative Procedure Act, the Paperwork Reduction Act (44 U.S.C. Ch. 35), and the Regulatory Flexibility Act (5 U.S.C. 601-612)

Executive Orders 12866 and 13563

OMB's Office of Information and Regulatory Affairs (OIRA) has determined that this interim final rule is significant for the purposes of Executive Orders 12866 and 13563. SBA, however, is proceeding under the emergency provision at Executive Order 12866 section 6(a)(3)(D) based on the need to move expeditiously to preserve the PPP lender records for law enforcement purposes.

This rule is necessary to prevent the loss of PPP loan records during the expanded statute of limitations period under the Harmonization Act. SBA anticipates that this rule will result in substantial benefits to law enforcement. As discussed above, as of December 31, 2023, DOJ has prosecuted thousands of cases of pandemic-related criminal fraud involving over a billion dollars in fraud loss. DOJ has a similar number of investigations that are open and yet to be charged. There have also been over a billion dollars in seizures and forfeitures issued in connection with stolen CARES Act funds. Further, the DOJ Civil Frauds Division has over 800 pending investigations for civil fraud enforcement actions related to the PPP Program, involving thousands of individuals and entities and billions of dollars in losses. DOJ believes that the numbers of these civil fraud investigations will continue to grow.

Extending the records retention requirements for PPP loan records will provide a substantial benefit to the government and the public by preserving records to allow law enforcement to continue to investigate and prosecute these criminal and civil fraud cases and recover taxpayer funds that were wrongfully obtained by these individuals and entities.

In this rule, SBA is not imposing new records retention requirements on the PPP lenders. Instead, SBA is extending existing records retention requirements ( print page 68094) for an additional period of time to allow continued investigation and prosecution of criminal and civil fraud cases. For this reason, SBA expects the costs incurred by PPP lenders due to the expanded records retention requirements to be de minimis.

Congressional Review Act and Administrative Procedure Act

The Congressional Review Act, 5 U.S.C. 801 et seq., as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, generally provides a major rule cannot take effect until 60 days after it is published in the Federal Register . This rulemaking has been reviewed and determined by OMB not to be a “major rule” under 5 U.S.C. 804(2).

As explained above, SBA has found good cause to bypass the Administrative Procedure Act's notice-and-comment and 30-day effective date delay requirements. 5 U.S.C. 553(b)(B), (d)(3).

Executive Order 12988

SBA has drafted this rule, to the extent practicable, in accordance with the standards set forth in section 3(a) and 3(b)(2) of Executive Order 12988, to minimize litigation, eliminate ambiguity, and reduce burden. The rule has no preemptive or retroactive effect.

Executive Order 13132

SBA has determined that this rule will not have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various layers of government. Therefore, SBA has determined that this rule has no federalism implications warranting preparation of a federalism assessment.

Paperwork Reduction Act, 44 U.S.C. Chapter 35

SBA has determined that this rule will require revisions to existing recordkeeping or reporting requirements of the PPP Program information collection, OMB Control Number 3245-0407. The revisions will have a de minimis effect on the costs associated with PPP lender recordkeeping. SBA has requested Office of Management and Budget (OMB) emergency approval of the revisions to the PPP lender recordkeeping requirements to prevent the loss of PPP loan records.

Regulatory Flexibility Act (RFA)

The Regulatory Flexibility Act (RFA) generally requires that when an agency issues a proposed rule, or a final rule pursuant to section 553(b) of the Administrative Procedure Act or another law, the agency must prepare a regulatory flexibility analysis that meets the requirements of the RFA and publish such analysis in the Federal Register . 5 U.S.C. 603, 604.

Rules that are exempt from notice and comment are also exempt from the RFA requirements, including conducting a regulatory flexibility analysis, when among other things the agency for good cause finds that notice and public procedure are impracticable, unnecessary, or contrary to the public interest. SBA Office of Advocacy guide: How to Comply with the Regulatory Flexibility Act, Ch.1. p.9. Since this rule is exempt from notice and comment, SBA is not required to conduct a regulatory flexibility analysis.

Authority: 15 U.S.C. 636(a)(36); 15 U.S.C. 636(a)(37); and 15 U.S.C. 636m; Coronavirus Aid, Relief, and Economic Security Act, Pub. L. 116-136, section 1114, and Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act, Pub. L. 116-260, section 303; PPP and Bank Fraud Enforcement Harmonization Act of 2022, Pub. L. 117-166.

Isabella Casillas Guzman,

Administrator.

Footnotes

1.  To the extent that a federally regulated PPP lender destroyed any PPP loan records before the effective date of this rule in accordance with a general internal records retention policy that was acceptable to the PPP lender's federal regulator, SBA will not enforce compliance by that federally regulated PPP lender with respect to the PPP loan records that were destroyed before the effective date of this rule.

2.  In addition to the approximately 11.8 million loans guaranteed by SBA, there were also loans where the borrower's application was withdrawn by the borrower, declined by the PPP lender, or the PPP lender cancelled the loan guaranty.

3.  On August 5, 2022, President Biden also signed the COVID-19 EIDL Fraud Statute of Limitations Act of 2022 extending the statute of limitations for criminal or civil enforcement actions alleging that a borrower engaged in fraud in SBA's COVID EIDL disaster loan program, EIDL Advance program and Targeted EIDL Advance program to not later than ten years after the offense was committed.

4.  See, COVID-19 Fraud Enforcement Task Force 2024 Report (April 2024), https://www.justice.gov/​coronavirus/​media/​1347161/​dl?​inline.

5.  Because PPP is authorized under section 7(a) of the Small Business Act, all lenders participating in the PPP Program are 7(a) Lenders.

6.  SBA Form 3507 lenders included numerous fintechs.

7.  See, e.g.,12 CFR part 749, Appendix A.