AI Meets the Paycheck Protection Program: FinCEN FAQs Underscore How the Regulatory Response to the Pandemic Is Accelerating the Adoption of Fintech

The COVID-19 pandemic provides a stark reminder about the importance of responding to rapid changes in a timely and expeditious manner. In the span of a few weeks, unemployment levels have skyrocketed to unprecedented levels, and government relief programs have been quickly overwhelmed. For example, the $350B Paycheck Protection Program (PPP), established under the Coronavirus Aid, Relief, and Economic Securities Act (CARES Act), went operational on April 10, 2020, and has been depleted in less than six days.

As a result, significant numbers of small business borrowers have for now and potentially permanently been shut out of the PPP. Those unable to access funds include borrowers who either:

• (i) Were unable to gather the required information for a PPP loan in a timely manner; or
• (ii) Submitted a timely application but were not able to be validated for Bank Secrecy Act (BSA) purposes by a lender because the applicant was a new customer or an existing customer raising potential issues under the lender's risk-based BSA compliance program.

Exacerbating the situation, official guidance from the Financial Crimes Enforcement Network (FinCEN), the administrator of the BSA, on the agency's expectations regarding customer due diligence and information collection requirements imposed on PPP lenders under the BSA (and FinCEN's Customer Due Diligence Rule (CDD Rule)), was not released until April 13, 2020, three days after the PPP went live. While FinCEN republished the frequently asked questions (FAQs) previously issued to PPP borrowers and lenders by the Small Business Administration (SBA), the brief delay, along with many other factors, contributed to the hesitancy of lenders to work with new as well as many existing customers.

By the time the guidance was issued, many lenders had already committed to a strategy of working with the customers they know best, thus, leaving many small businesses for which adequate BSA customer due diligence had not been conducted, and/or insufficient information had been collected due to the time required to conduct a BSA review, without any recourse to secure a PPP loan before the available funding was depleted.

While the FinCEN release included only the two republished FAQs, the agency indicated that it will update the FAQs with additional BSA-related FAQs involving the PPP. This, of course, leaves open the possibility of additional future requirements and accompanying challenges for certain prospective small business borrowers, assuming an additional round of funding is provided for the PPP.

From a policy perspective, the FinCEN FAQs are relatively straightforward, not particularly burdensome or novel, consistent with the objectives of the BSA, and, generally speaking, lender- and borrower-friendly. As described below, both questions address a lender's obligation to collect beneficial ownership information under the BSA, with the first focused on expectations for gathering beneficial ownership information on existing customers and the second discussing requirements imposed on lenders to gather beneficial ownership information on natural persons having a 20 percent or greater ownership stake in the applicant business.

Obligation to Collect Beneficial Ownership Information

Under FinCEN's CDD rule, a covered financial institution is required to identify and verify the identity of the natural persons (also referred to as beneficial owners) or legal entity customers who own, control, and profit from companies when those companies open accounts. There is a 25 percent ownership threshold for the CDD rule that triggers this requirement. In order to comply, a covered financial institution must establish and maintain policies and procedures designed to:

1. Identify and verify the identity of customers;


2. Identify and verify the identity of the beneficial owners of companies opening accounts;


3. Understand the nature and purpose of customer relationships to develop customer risk profiles; and


4. Conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

While straightforward in concept, the application of the guidance and FinCEN's CDD Rule to new and riskier existing customers requires the time and attention of the compliance staff of lenders already under siege from a crushing wave of PPP loan applications. Even in the most favorable circumstances, the beneficial ownership requirements and the information needed to collect, certify or verify beneficial ownership information can be difficult to gather and evaluate.

As a result, while many depository institution lenders have already adopted artificial intelligence (AI) solutions to address BSA/Anti-money laundering (AML) and Office of Foreign Assets Control (OFAC)/sanctions compliance program requirements and new customer identification programs and procedures, it is clear that the institutions with the strongest (i.e., fastest and most reliable) AI platforms in these areas will always have a significant competitive advantage over institutions with less robust programs. Moreover, this competitive differential is likely to be most pronounced during times of stress or significant market activity in which rapid and accurate execution is essential.

Key Takeaways From FinCEN's FAQs

One item of clarification lenders sought with regard to their obligation to collect beneficial ownership information is how they can and should treat existing customers versus new customers. The key takeaways for each type of customer and the AI implications are described below:

Existing Customers

A lender does not need to re-verify a borrower's beneficial ownership information when extending a PPP loan to an existing customer who has already had their beneficial ownership information verified. In addition, if the lender is a federally insured depository institution that has not yet collected beneficial ownership information from an existing customer, the lender does not need to collect and verify beneficial ownership information unless required by the lender's policies implementing a risk-based approach to BSA compliance. Thus, for existing customers, there is a significant opportunity for an AI-based solution not only to validate a customer with a riskier profile but to do so expeditiously and in a manner that will preserve the ongoing customer relationship without exposing the lender to future issues that could surface because the ownership information was not reviewed and validated.

Also under the FAQs, insured depository institutions eligible to participate in the PPP do not need to collect beneficial ownership information for owners holding a 20 percent or greater ownership interest in an applicant borrower if such information was previously verified by the lending institution. Again, while not needed, an effectively deployed AI-based platform not only would identify potential issues arising from changes in beneficial ownership, it would also be able to identify issues not previously detected by compliance policies and procedures not AI-based or based on a more rudimentary AI platform.

New Customers

Under the PPP, a lender is required to collect information from the applicant regarding every owner who has an ownership stake of 20 percent or greater (as mentioned above, the BSA requirement is 25 percent) if the applicant is a new customer.

FinCEN has clarified that a lender's obligation to collect beneficial ownership information under the BSA is satisfied if they collect the following information from all natural persons with a 20 percent (PPP specific) or greater ownership stake in the applicant business: (i) owner's name, (ii) title, (iii) ownership percentage, (iv) taxpayer identification number, (v) address, and (vi) date of birth. If the ownership interest belongs to a business or other entity, the lender will need to collect appropriate beneficial ownership information for that entity. Thus, if a lender's customer is owned by Company A and Company B equally, the lender must collect beneficial ownership information of Company A and B to the extent that the owners of Company A and B indirectly own 20 percent of the lender's customer.¹ Clearly, a robust, effective and, perhaps most importantly, expedient AI-based customer due diligence solution would excel in gathering, validating and verifying the information required above for the beneficial owner of a 20 percent or greater ownership interest in a prospective PPP borrower.

Understanding the importance of the opportunity created in the limited context of the recent FinCEN guidance, a number of AI-based BSA/AML compliance solution providers have moved aggressively to work with lenders on customer information programs and "know your customer" initiatives aimed squarely at the PPP.² While BSA/AML and OFAC/sanctions compliance programs have benefited the most from AI-based solutions in the financial services context in recent years, other fintech providers are also seeing opportunities to provide assistance to lending institutions participating in the PPP.³

Certainly, the challenges presented to lenders and regulators in connection with the rapid rollout of the PPP present an obvious and somewhat simplistic example of how the adoption of AI and other fintech solutions can provide effective measures to satisfy regulatory, supervisory and compliance requirements. More important will be fintech innovations that are being and will be developed to assist consumers and institutions working to assist consumers in dealing with COVID-19.

Finally, perhaps the most compelling reason we are likely to see the accelerated adoption of fintech solutions will be the openness of regulators to accept a greater degree of flexibility and experimentation in the delivery of financial products and services both to promote the greater good and to bolster their own regulatory and supervisory programs to keep up with the ever-increasing rate of change, i.e., in the industries they regulate, resulting from the fintech response to COVID-19.

More COVID-19 resources, including DWT's prior writings on the PPP, are available here.

The facts, laws, and regulations regarding COVID-19 are developing rapidly. Since the date of publication, there may be new or additional information not referenced in this advisory. Please consult with your legal counsel for guidance.

DWT will continue to provide up-to-date insights and virtual events regarding COVID-19 concerns. Our most recent insights, as well as information about recorded and upcoming virtual events, are available at www.dwt.com/COVID-19.

FOOTNOTES

1  For a full illustration, see question 3 of FinCEN's FAQs regarding CDD requirements for financial institutions.
2  See, e.g., VITAL4 to Assist Banks With AML/KYC Compliance by Offering Free Subscriptions to VITAL4SEARCH Amid COVID-19 Crisis, Baker City Herald (April 16, 2020) and Fenergo Launches Remote Account Opening Solution to Accelerate Small Business Emergency Loan Approvals, PR Newswire (April 16, 2020).
3  See "Fintechs Help Banks Manage Deluge of Emergency Small-Business Loans," M. Cross, American Banker (subscription) (April 14, 2020).