Paycheck Protection: capital was easy, intake was hard

The week

On April 3, 2020, the Paycheck Protection Program, known as PPP, opened to applications from small businesses and sole proprietors; independent contractors and self-employed individuals became eligible from April 10. Congress had written it into the CARES Act as the answer to the question every owner of a small restaurant, dental practice or landscaping company was asking that month: how do I keep paying my people?

The design was unusual. Private lenders, banks, credit unions and other approved institutions made the loans. The Small Business Administration, the federal agency that supports small firms, guaranteed them, meaning the government would stand behind the loans if they were not repaid. And forgiveness was available if the funds were used for payroll and certain other costs. A loan used as intended could turn into something close to a grant. That made PPP very attractive, and it made the first week a stampede.

The terms came from an interim final rule that SBA released on April 2 and later published in the Federal Register. Loans carried a one percent interest rate and a two-year maturity, with payments deferred for six months while interest accrued. A borrower could ask for up to two and a half times its average monthly payroll, capped at $10 million, with pay above $100,000 a year per employee left out of the calculation. Under the original rule, at least 75 percent of the forgiven amount had to come from payroll costs.

The rule also set out how lenders would be paid and protected. SBA paid processing fees of five percent on loans up to $350,000, three percent on loans between $350,000 and $2 million, and one percent above that. Lenders could rely on borrower certifications for eligibility and use of proceeds, and SBA said it would hold them harmless for that reliance. Borrowers applied on SBA Form 2483, and the program was explicitly first come, first served.

Lenders faced very high demand, far beyond anything their small business teams were built for. Guidance from SBA and the Treasury Department was frequently updated, sometimes in ways that changed how applications should be handled after work on them had already begun. And lenders reported intermittent access problems with E-Tran, SBA’s system for submitting loans. E-Tran is the online gateway through which a lender registers each loan with SBA and receives the loan number that makes the guarantee real. SBA said the problems did not amount to an outage. For staff trying to submit loans late at night, the distinction may have felt academic.

Lender participation was broad. Banks, credit unions, Farm Credit institutions and a set of newly approved non-bank lenders all took part. By the time the first round of funding ran out in mid-April, SBA and Treasury reported more than 1.6 million approved loans from nearly 5,000 lenders. Most of those lenders had never processed anything close to that volume through SBA.

Some large banks initially limited applications to existing customers, a decision that drew criticism from businesses without such relationships, and that, as we will see, had an operational logic behind it.

The first-come rule made timing a competitive matter between businesses, and a capacity matter for lenders. A business whose bank could not take its application on the first day risked missing the money altogether. Every hour a lender spent sorting out its intake was an hour its customers spent further back in the national queue.

The money side of the program, meanwhile, was being settled. That week the Federal Reserve, the nation’s central bank, announced a facility to provide liquidity to lenders against PPP loans, releasing its terms on April 9. Liquidity simply means ready cash. The facility let lenders pledge their PPP loans to the Fed and receive funding in return, so that making a flood of new loans would not drain their own balance sheets.

The facility, named the Paycheck Protection Program Liquidity Facility, took PPP loans as collateral at face value. It was announced alongside the Main Street Lending Program and other measures that the Fed said could provide up to $2.3 trillion in loans to support the economy. The CARES Act had already given PPP loans a zero risk weight for bank capital purposes, so the loans did not consume capital the way ordinary business loans would.

One institution needed a separate fix. On April 8, the Federal Reserve Board said it would temporarily and narrowly modify the growth restriction it had imposed on Wells Fargo in 2018 after compliance failures. PPP and Main Street loans would not count against the bank’s balance sheet cap, provided the bank passed the benefits of that lending to the Treasury or to Fed-approved nonprofits supporting small businesses. Even a regulator’s balance sheet limit was being moved out of the way.

With the guarantee and the Fed facility in place, lenders did not need to worry much about where the money would come from. Their real problem lay in the less glamorous work of getting applications in, checked and through the government’s door.

Consider a community bank on the morning of April 3, 2020. Its small business lending team is a handful of loan officers who know most of their customers by name and usually make a modest number of loans in a month. By lunchtime, the inbox has filled with applications, many of them photographs of payroll reports taken on phones, some of them from businesses the bank has never heard of. The phones in every branch are ringing. Half the operations staff are working from home. And the government’s submission system works for a while, then does not.

The Paycheck Protection Program put private lenders between the federal government and millions of small businesses. Funding was the easy part, because the SBA guarantee and the Federal Reserve facility took care of it. Lenders hit their limits elsewhere, in three operational stages: taking in applications, verifying what the program and existing law required, and submitting loans to SBA and funding them. Each stage fell on a different part of the workforce, and each showed what really sets an institution’s capacity when volume arrives overnight.

Those three stages are the backbone of what follows, after a short primer on how a business loan normally moves through a lender. Two further sections then look across the stages: at the workforce that had to staff all three at once, and at the risks the program put on a lender’s register. The argument throughout is that a lender’s capacity in April 2020 was set by its workflow and its people, because the balance sheet question had already been answered.

How a business loan normally moves through a bank

Executives outside lending may never have seen a loan from the inside. A few terms will recur.

• Intake. Everything involved in receiving an application: the form, the supporting documents and the first check that everything is there.
• Underwriting. Deciding whether to lend and on what terms, based on the borrower’s finances and risk. PPP simplified this dramatically, because the government set the terms and guaranteed the loan.
• Know your customer and BSA/AML. The Bank Secrecy Act and anti-money laundering rules require banks to verify who their customers are and watch for financial crime. For a business, that includes identifying its beneficial owners, the individuals who own or control it.
• Core banking system. The central ledger that holds every account and loan. If a loan is not “booked” there, as far as the bank’s books are concerned it does not exist.
• API. An application programming interface, a defined way for one computer system to send requests to another automatically, so that machines exchange the data rather than people retyping it.

The economics of a PPP file

The fee schedule shaped behavior in ways that are easy to miss. A lender earned five percent on a small loan and one percent on a large one. A $50,000 loan therefore paid $2,500, and a $5 million loan paid $50,000, while the processing work was not ten times as great for the larger file. Per file, larger loans paid far more, even though smaller loans paid a higher percentage.

That gap mattered when every reviewer hour was scarce. A lender with a fixed number of people could rationally work its larger existing customers first. Many did, and the pattern drew criticism from very small businesses and their advocates. The program’s design pushed in that direction as much as individual lender choices did. Congress responded in the second round with money reserved for smaller lenders and community institutions.

Booking a loan the core had never seen

The core banking system needed a new product before the first loan could be booked. PPP loans combined features that rarely appear together. They carried a fixed one percent rate, a six-month deferral during which interest accrued and a two-year term. They had a full federal guarantee and an expected payoff from SBA on forgiveness. Banks that relied on their core vendor waited for a release. Others set up the product themselves and tested it on live loans. Either way, product setup was part of the critical path, alongside intake and review.

Finance teams had their own work. Processing fees received from SBA could not be booked as income on the day they arrived. Under the usual accounting for loan fees, net fees are generally deferred and recognized over the life of the loan, with forgiveness speeding that up. Controllers who set that treatment early avoided restating it later.

Small business lending at most banks and credit unions is relationship-based and paced by loan officers. A loan officer meets the owner, gathers documents, and shepherds the file through credit, compliance and closing over days or weeks. That model is personal and careful. It is not built for thousands of applications in a weekend, which is exactly what PPP delivered.

Intake: a flood of applicants and documents

PPP brought in many times the usual volume of applications within days, often with payroll documents in inconsistent formats. Institutions without a digital intake channel fell back on email and shared drives. That was unmanageable within days, and it moved payroll records and tax documents through ordinary inboxes.

That second point deserves attention. Payroll records and tax documents contain names, Social Security numbers and bank details. Sending them through ordinary email and storing them in shared folders spreads sensitive information across many places, with little control over who can see it and no reliable way to track it. Nobody can later say who opened which file.

Institutions with digital account opening or online lending platforms adapted them, sometimes with fintech partners, the technology companies that build lending and payments software. Others built simple web forms and document portals in days. A workable intake design had four elements:

1. A structured application form, so that each answer lands in a defined field rather than in an email.
2. A document upload tied to the application, so that the payroll report and the form stay together.
3. An automatic acknowledgment with a reference number, so the applicant knows the bank has the file.
4. A queue that showed each file’s status, from received, to under review, to submitted, to funded.

Without the status queue, applicants called branches to ask, and branch staff could not answer. Every one of those calls took time from people who could have been reviewing files, and every unanswered question eroded trust. A simple status page does more for customer patience than any apology script.

What the intake data had to contain

The maximum loan amount was a calculation, and most errors started at intake. A lender needed twelve months of payroll costs, broken down so that compensation above $100,000 per employee could be excluded. It needed to know whether the business had an Economic Injury Disaster Loan from the early weeks of the crisis, because those balances could be folded into PPP. Self-employed applicants, eligible from April 10, needed different inputs again.

An application form that captured these as separate fields could compute and check the amount automatically. One that took a single “requested amount” relied on the borrower’s arithmetic. When guidance on the calculation changed, structured inputs could be recalculated in bulk. A free-text request could only be revisited file by file.

How intake differed by type of lender

• Community banks knew many applicants personally, which made identity simpler but did nothing for volume. Their constraint was a small team and, often, a core system that needed a vendor update for a new loan product.
• Credit unions generally lend only to members, so an applicant without an account first had to join. That added an account-opening step, with its own identity checks, in front of every new borrower.
• Large banks had digital channels and automation budgets, but also enormous customer bases. Even their existing-customer queues were large enough to overwhelm review teams in the first days.
• Non-bank lenders and fintechs often had the best online intake. Many were new to SBA lending and to the program’s compliance expectations, which mattered in the next stage.
• Community development financial institutions and minority depository institutions served borrowers that larger lenders often turned away. They faced high demand, thin staffing and borrowers whose records were less tidy than a large bank’s typical commercial client.

Day five at two lenders

Suppose two lenders reach the end of the first week. One had, a year earlier, launched a modest online account opening service for small businesses. Its team reused that service as a PPP application page: the same form engine, the same document upload, a new set of questions. Each applicant received a reference number by email, and a simple status page showed where each file stood. Inside the bank, files arrived in a work queue sorted by completeness, so redeployed branch staff could pick up the next file, run through a twelve-item checklist and either pass it on or flag it for a specialist.

The other had no such service. Its loan officers published an email address and asked applicants to send the form and supporting documents. By day five, that mailbox held thousands of messages, many with several attachments, some replies to earlier messages with corrected documents. Nobody could say how many complete applications the bank had, which ones were from existing customers, or which had already been submitted to SBA. Staff spent much of their time searching the mailbox and answering calls from owners asking whether their email had arrived.

Both banks had dedicated, hardworking people, and neither had a smarter credit policy. The first bank’s advantage was that its work arrived in a shape people could process, and that everyone, inside and outside the bank, could see where each file stood.

Turning generalists into reviewers

Staff from branches, wealth management and operations were redeployed to review files. Redeployment worked only where the work had been broken into simple steps that people from other roles could perform. A checklist for completeness, a second-level reviewer for exceptions, and a short daily briefing on guidance changes turned generalists into productive reviewers within a day or two.

A busy kitchen works the same way. A skilled chef can cook a whole meal alone, slowly. A kitchen that splits the work into stations, with a clear recipe card at each, can serve a full dining room, and a new cook can start at the simplest station on day one. In the PPP back office the checklist was the recipe card, and the second-level reviewer handled anything unusual.

Verification: what lenders still had to check

SBA guidance let lenders rely on borrower certifications for many program requirements, such as payroll amounts and the necessity of the loan. A certification is a signed statement from the borrower that something is true, with legal consequences if it is not. It did not suspend Bank Secrecy Act and anti-money laundering obligations. For existing customers, lenders could generally rely on the due diligence already performed. For new customers, they had to collect and verify customer and beneficial ownership information in the usual way.

That distinction explains why some large banks initially limited applications to existing customers. New customers needed onboarding work that existing customers did not, and onboarding teams were already stretched. It was partly a commercial choice to favor existing relationships, and partly a way of keeping the volume of fresh identity checks within what teams could actually do.

When the rules change mid-week

Compliance teams had to write and keep updating procedures as SBA issued interim final rules and frequently asked questions, sometimes several times in a week. Version control for procedures turned into a real control. Each file needed to show which guidance applied on the date it was processed, so that later reviews could judge it fairly.

What non-bank lenders had to build

The SBA rule drew a sharp line between lenders that already lived under the Bank Secrecy Act and those that did not. Banks and credit unions were told to keep their existing procedures. Lenders not already subject to the Act had to establish an anti-money laundering program comparable to a federally regulated institution’s before they made PPP loans. That covered customer identification and, for business borrowers, beneficial ownership collection. They could also rely on an insured institution’s customer identification program.

For a new non-bank lender, that meant writing a program, appointing a compliance officer, choosing identity verification tools and training staff, all in days. A program written in that time can be sound on paper and thin in operation. That gap mattered later, when investigators traced fraudulent loans back to the lenders and service providers that processed them.

Version control means keeping every edition of a document with the date it took effect, rather than overwriting the old one. It matters because hindsight is unforgiving. A reviewer looking at a file a year later will apply the rules as they understand them. If the bank can show that a different instruction was in force on the day it processed the loan, the file is judged against the right standard.

How much checking before the money goes out

Fraud screening sat in the same stage. Basic checks, such as matching the business to public registrations, confirming the account holder’s identity, and comparing claimed payroll with deposit history, could run in minutes for existing customers. They were slower for new ones. Every lender had to decide how much verification to run before funding, knowing that speed was the program’s purpose.

That decision is better made explicitly than by default. A lender can set tiers: existing customers with clean histories proceed on certification plus automated checks, while new customers or files with mismatches go to a reviewer before funding. Writing the tiers down, and recording which tier each file followed, gives the institution a defensible position when auditors, SBA reviewers or prosecutors later examine individual loans. It also tells redeployed staff exactly when to escalate.

Suppose a credit union writes a one-page rule on day two: existing members with at least a year of account history and matching payroll deposits go straight through; everyone else goes to a second reviewer. A year later, an examiner questions a loan. The credit union can show the rule, the tier the file followed and the checks that ran. Compare a lender that simply did “as much as we could” each day. It has no rule to point to, and every file becomes an argument.

Who carried the risk on a bad loan

The federal guarantee and the hold-harmless language made the credit risk small, but they did not make the lender’s risk disappear. SBA could deny a guarantee or forgiveness where a lender had not followed program rules. Suspicious activity reporting obligations still applied, so a bank that spotted a likely fraudulent application was expected to report it as it would any other suspicious transaction. And in May, SBA said it would review every loan over $2 million, which meant the largest files would certainly be read again.

For larger files, the review risk landed on the borrower’s certifications and the lender’s documentation together. A lender that could show the file, the checks run and the guidance in force was in a strong position. A lender that could only show that the loan had been funded was not.

Patterns worth screening for

The fraud patterns that later surfaced were not exotic. They included businesses that did not exist, real businesses with inflated payroll, stolen identities, and the same applicant seeking loans from several lenders at once. Many could be caught by simple checks. An employer identification number might not match the business name. A registration might postdate February 15, 2020, the date by which a business had to be operating. A payroll figure might sit far above the deposits the account had seen.

A lender could also look across its own queue. Duplicate tax identification numbers, bank accounts or addresses across applications are a strong signal, and a sort in a spreadsheet would find many of them. What no single lender could see was an applicant applying elsewhere. That cross-lender view belonged to SBA, and its absence was a design gap that lenders could not close alone.

The case for speed over checking

The strongest counter-argument deserves a fair hearing. Congress designed PPP to move money in days, on borrower certification, with lenders held harmless. Payrolls were due every two weeks and businesses were closing. Each extra check delayed a legitimate borrower, and the borrowers most likely to fail extra checks, those with informal records and no banking relationship, were often the ones in the most trouble. Restricting lending to existing customers kept fraud down, but left many small and minority-owned businesses waiting.

All of that is true, and it is why the answer is a tiered rule rather than maximum checking. Written tiers let a lender move existing customers fast and still give new customers a defined path, with a reviewer, rather than a refusal. The tier decision is where speed and control get balanced deliberately. Without it, the balance gets struck by whoever happens to be holding the file.

Submission and funding: the government system as bottleneck

Every loan needed an SBA loan number through E-Tran, which was not built for the volume. Intermittent access problems, which lenders reported and SBA disputed, meant staff worked through the night to submit when the system was available. Larger lenders later submitted in batches through automated interfaces, while many smaller lenders continued to key loans one at a time.

The two approaches differ enormously in capacity. An automated interface lets the bank’s systems send many loans to SBA at once and handle the replies. Keying by hand means a person types each loan into a web screen, one at a time, and starts again if the screen times out.

Throughput depended on the slowest system in the chain, and that system belonged to the government. Any institution that measures its performance only by its own systems should find this humbling. Queuing with automatic retry, clear status for each application, and a reconciliation between approved, submitted and funded loans mattered as much as underwriting speed. Automatic retry means that when the government system rejects or drops a submission, the lender’s system tries again later on its own, rather than relying on someone to notice.

Funding added its own checks: confirming the deposit account, booking the loan in the core system, and generating the note and disclosures, the legal documents that set out the loan’s terms. Each handoff was a point where a file could stall unnoticed. A daily reconciliation, comparing how many loans were approved, how many had SBA numbers and how many had actually been funded, made stalls visible before an angry customer did.

Retries without duplicates

Automatic retry has a trap. If a submission times out, the lender may not know whether SBA received it. Sending it again risks two loan numbers for one borrower, which is a reconciliation problem at best and a duplicate disbursement at worst. The safer design gives every application a single internal identifier, checks for an existing SBA response before resubmitting and writes the loan number back to the file the moment it arrives.

Lenders keying by hand faced the same trap in human form. A reviewer whose screen froze could not tell whether the loan had gone through. A shared log, recording each attempt with a time and the person who made it, let the next shift check before trying again.

Two windows and a set-aside

The submission bottleneck shaped the second round as well. The Paycheck Protection Program and Health Care Enhancement Act, signed on April 24, 2020, raised the program’s authority from $349 billion to $659 billion. It reserved at least $30 billion for loans from banks and credit unions with $10 billion to $50 billion in assets. It reserved at least $30 billion more for community financial institutions and for banks and credit unions under $10 billion.

The program reopened on April 27, and lenders again reported that SBA’s systems struggled under the load. Set-asides by lender size were Congress’s way of rationing access to a shared bottleneck that the first round had allocated by speed. For a smaller lender, the lesson for its own operations was simple: the rules of the queue can change between rounds, and the submission process needs to adapt quickly when they do.

What the reconciliation should catch

A good daily reconciliation compared at least four counts: applications complete, approved by the lender, assigned an SBA loan number and funded. Each gap had a typical cause. Complete but not approved usually meant a reviewer backlog. Approved without a loan number meant a submission failure or a rejection waiting in a queue. A loan number without funding meant a closing or account problem. Funded without a loan number should never happen, and if it did, the lender had advanced money without the guarantee.

The workforce behind the workflow

Remote work made all three stages harder. Reviewers at home needed secure access to document repositories, a fast way to escalate questions, and clear rules for handling customer documents outside the office. Institutions that had already moved operations staff onto laptops and cloud collaboration tools redeployed people in a day. Those still tied to desktop workstations and paper files spent the first week on logistics.

Roles a COO had to fill

Turning a branch network into a loan factory meant naming roles that did not exist the week before:

• A program lead who owned the daily numbers and the decisions on priorities.
• A guidance desk, often one or two people in compliance, who read every new SBA rule and FAQ and turned it into a dated procedure change.
• First-level reviewers, redeployed from branches and operations, working the completeness checklist.
• Second-level reviewers, experienced lenders or compliance staff, handling exceptions and fraud flags.
• A submission team that worked the SBA system, including outside normal hours.
• A closing and funding team that generated documents, booked loans and moved money.
• A customer response team answering applicant calls from the status queue.

Most institutions filled these roles informally, by asking who was free. Those that wrote them down, even on a single page, could move people between them as the bottleneck shifted from intake to review to submission over the first weeks.

Partners and service providers

Many lenders brought in outside help: technology firms for intake, lender service providers for processing, and outsourced call centers. Each relationship is a third-party arrangement that bank regulators expect lenders to oversee, with due diligence proportionate to the risk. In April 2020 that due diligence was compressed into days. The practical minimum was a written agreement covering data protection, who performs which checks, what the provider must report back and how the lender can audit the work. Where the provider made the fraud decisions, the lender still owned the outcome.

Training in a day, every day

Redeployed staff needed more than one training session, because the rules kept changing. A fifteen-minute huddle at the start of each shift covered three things. They were what guidance had changed since yesterday, the most common errors found in yesterday’s files, and who to call for which kind of exception. The guidance desk ran it, and the checklist was updated before the huddle rather than after. Reviewers then worked from the same version of the rules at the same time.

Measuring the line

Four measures told a program lead where the line was stuck. They were files reviewed per reviewer per day, time from complete application to SBA submission, the share of files escalated to second-level review, and the share sent back for rework. A rising rework rate was the early warning that guidance had changed and the checklist had not. A falling review rate usually meant reviewers were spending their time on calls rather than files.

Handling documents outside the office

Remote review created a data protection problem as well as a productivity one. Tax returns and payroll reports were being opened on home networks, sometimes on personal devices, and sometimes printed. A short rule set covered most of the risk: documents opened only within the bank’s systems, no local downloads, no printing at home and no forwarding to personal email. Institutions that already ran virtual desktops could enforce those rules technically. Others relied on instructions and trust, which is weaker but far better than silence.

For a COO, this is the heart of the story. The scarce resource was not money or even technology in the abstract. It was trained, equipped people who could be pointed at a new task quickly. That depended on decisions made long before: whether work was documented in simple steps, whether staff had portable equipment, and whether anyone had thought about how a branch teller might become a loan reviewer for three weeks.

The pattern across the stages is consistent. Capacity in a surge comes from standard steps, simple tools, current procedures and visible status. Institutions that treat surge capacity as a designed capability, with a playbook and trained reserve staff, can reuse it for fraud spikes, system conversions and remediation work.

Every risk on the register at once

PPP touched nearly every concern on a lender’s risk register at once:

• Customers and reputation. Small business owners remembered who answered their calls and who got their money out.
• Regulatory and legal exposure. Identity checks, document handling and adherence to changing guidance would all be reviewed later.
• Fraud. High volumes and a mandate for speed are exactly the conditions criminals look for.
• Staff. Redeployed employees worked long hours under pressure, often from home, and needed clear instructions to avoid mistakes.
• Revenue. Lenders earned fees on PPP loans, and those that served small businesses well had a chance to win lasting relationships.

Fair lending and the existing-customer rule

Prioritization raised a fair lending question that compliance teams had to answer quickly. The Equal Credit Opportunity Act applies to business credit, and PPP loans were credit. Lawsuits filed that spring accused several large banks of favoring larger or existing customers. Whether or not such claims succeed, a lender’s prioritization rules should be written, applied consistently and reviewed for whether they disadvantage protected groups. A rule such as “existing customers first” may be defensible on operational grounds, but the institution should be able to show it considered the effect and what it did for applicants outside the rule.

What PPP crowded out

The surge had second-order effects that showed up weeks later. The same weeks brought payment deferral requests on consumer and business loans, mortgage forbearance under the CARES Act and a wave of account changes. Staff pulled onto PPP were not handling those queues. Alert reviews in BSA monitoring could also back up while analysts worked on loan files. A lender that tracked its other backlogs alongside PPP volume could see the trade-off it was making and set a date to clear them.

The lenders that coped had a structured digital intake with a status queue; checklists that let generalists review files; procedures under version control; written verification tiers; automated, retried submissions; and a daily reconciliation from approval to funding. The ones that struggled had the reverse: email intake, undocumented judgment calls, overwritten guidance, and no single view of where each file stood.

Surge capacity is built before the surge

1. If a government program sent us many times our normal application volume next week, how would applications reach us, and where would sensitive documents end up?
2. Which of our processes are broken into steps simple enough for staff from other departments to perform after a day’s training?
3. Do we have a named reserve of staff who could be redeployed, and do they have laptops and secure remote access today?
4. Have we written down, in advance, which checks run before funding for which kinds of customer?
5. Do we reconcile approved, submitted and funded items daily, and who acts on the gaps?

With hindsight

The first round of funding was exhausted on April 16, 2020, less than two weeks after the program opened, and Congress added more within days. The program ran in further rounds into 2021, and forgiveness processing created a second operational wave as lenders reviewed applications and submitted them to SBA. The intake, verification and submission machinery that lenders built in a hurry in April had to run again, more than once, and then run in reverse to process forgiveness.

The rules kept moving after that first week. In late April SBA guidance pressed borrowers, particularly public companies with access to other capital, to reconsider their certification that the loan was necessary, and offered a window to repay without penalty. Several well-known companies returned their loans. In May, SBA said borrowers that, together with affiliates, received less than $2 million would be deemed to have made the necessity certification in good faith. In June, the PPP Flexibility Act lowered the payroll share needed for full forgiveness to 60 percent and lengthened the period for using the funds.

Each change reached back into files that lenders had already processed. Lenders that recorded which guidance applied on which date could show they had followed the rules in force. The program closed in August 2020, reopened in January 2021 with second-draw loans for harder-hit businesses, and stopped taking applications in 2021 after making roughly $800 billion in loans. The Fed’s liquidity facility was extended for a final time to July 30, 2021.

Forgiveness eventually got simpler for small loans. SBA introduced shorter forgiveness forms for smaller loans, and in 2021 it opened a platform that let borrowers with smaller loans apply directly to SBA where their lender had opted in.

Community banks and credit unions made a large share of the loans, and many gained business customers who had been turned away elsewhere. That is a reminder that operational capability is also a commercial asset. Institutions that could take in, check and fund applications quickly served their communities and won relationships that outlasted the program.

The fraud that followed was substantial. In 2023 the SBA Office of Inspector General, the agency’s independent watchdog, estimated that more than $200 billion in pandemic-era EIDL and PPP funds may have gone to potentially fraudulent actors. EIDL, the Economic Injury Disaster Loan program, was a separate SBA pandemic program. Reliance on self-certification, high volumes and pressure for speed all contributed.

The OIG put the potentially fraudulent share at no less than 17 percent of the roughly $1.2 trillion disbursed across the two programs. It described SBA’s controls as calibrated for speed, creating a “pay and chase” environment. Congress had already lengthened the clock for pursuing that fraud. The PPP and Bank Fraud Enforcement Harmonization Act, signed on August 5, 2022, gave prosecutors and civil enforcers ten years from the offense to bring PPP fraud cases. Lender files from April 2020 may therefore be pulled into investigations into the 2030s.

Later scrutiny also sorted lenders by how they had worked. In late 2022 a House select subcommittee report faulted several fintech-affiliated lenders and lender service providers for weak fraud controls, and academic researchers reached similar conclusions about parts of that segment. Fast digital intake, on its own, had not been enough. The institutions that came through best combined good intake with deliberate verification and records that showed both.

The trade-off lenders faced in April 2020, between getting money out quickly and checking who received it, remains the central design question for any future emergency lending program. There is no setting that removes the tension. Check too little and money goes to criminals. Check too much and the businesses the program exists to save wait while their payrolls lapse.

What leaders can control is how deliberately they make that choice. A written verification tier, applied consistently and recorded on each file, does not eliminate fraud. It does mean the institution decided, rather than drifted, and can show its reasoning when questions come. Combined with a standing surge playbook and a reserve of trained, equipped staff, it is the best preparation available for the next time a program arrives with very little warning.