On March 27, President Donald Trump signed into law the Coronavirus Aid, Relief, and Economic Security Act, also known as the CARES Act, which commits over $2 trillion for stimulus spending, federal grants, and loan programs and guarantees by the federal government.

One critical component of the CARES Act is the Paycheck Protection Program (PPP) that is being administered by the Small Business Administration (SBA). The PPP allows small businesses to seek forgivable loans of up to $10 million that are to be used to pay for eight weeks of a business's payroll costs plus some expenses such as rent and utilities. Most of the loans will be forgiven if companies use the money to retain workers or hire back employees that were cut. The SBA has waived many of its usual requirements for these loans and will not require collateral or a personal guarantee for them, but businesses must still apply for the loans through a bank or other lender and must certify compliance with the PPP's eligibility requirements.

The availability of funds under the CARES Act will provide important relief to many companies. This relief, however, is not risk-free and care must be taken by participants in CARES Act programs to minimize enforcement risk by the Department of Justice (DOJ) and private "whistleblowers" down the road.

The False Claims Act and the CARES Act

The False Claims Act (FCA), 31 U.S.C. 3729-3733, was enacted during the Civil War to address extensive fraud encountered in government procurement and remains an important enforcement tool to police government-funded programs. The FCA imposes both criminal and civil penalties for submitting-- or causing to submit--false claims to the government for payment. The statute permits the DOJ as well as qui tam relators--individuals claiming to have direct and independent knowledge of fraud--to bring civil suits against government contractors and other federal program participants to recover damages and penalties. Potential liability under the FCA can be significant, including a civil penalty--currently between $11,463 and $23,331--for each false claim, up to three times the government's actual damages, and attorney's fees.

Although the FCA is not specifically mentioned in the CARES Act, the implications for FCA enforcement are likely to be significant. The CARES Act contains built-in oversight mechanisms that include a Special Inspector General for Pandemic Recovery (SIGPR) that has a mandate to conduct audits and investigations of loans and loan guarantees made in connection with the stimulus package. The SIGPR has broad authority to issue subpoenas and make arrests, and it will work closely with the DOJ and US Attorney's Offices to prosecute misconduct. In fact, the DOJ has already announced it will "prioritize the investigation and prosecution of Coronavirus-related fraud schemes" and has established a national hotline for whistleblowers to report suspected fraud.

A "claim" under the FCA is any demand for money or property made directly to the federal government or to a contractor, grantee, or other recipient if the money is to be spent on the government's behalf and if the federal government provides any of the money demanded or if the federal government will reimburse the contractor or grantee. Small businesses seeking loans under the PPP will therefore be making "claims" for stimulus funds and will be subject to the strictures of the FCA.

Regardless of the recipient or form of the stimulus funds, FCA liability can attach when a person or business knowingly submits a false claim to the government, causes another to submit a false claim to the government or knowingly makes a false record or statement to get a false claim paid by the government.

False Certifications

Claims may be either factually false or legally false under the FCA. A claim is factually false when a claimant knowingly submits information that is untrue on its face and misrepresents the goods or services that it provided to the government.

A claim is legally false when a claimant knowingly submits a false certification that it has complied with a statute, regulation or contractual term, the compliance with which is a condition for government payment.

FCA claims based on legal falsity can rest on one of two theories: express false certification and implied false certification. An express false certification occurs when a claimant falsely certifies compliance with a particular statute, regulation or contractual term, where compliance is a prerequisite to payment.

An implied false certification occurs where the claimant fails to disclose that it violated statutes, regulations or contractual terms that affect its eligibility for payment. "Under the theory of implied certification, FCA liability may arise even absent an affirmative or express false statement, where submission of such documents represents an implied certification by a contractor of its continuing adherence to all material portions of the contract."1

Falsely certifying compliance of products or services provided to the government is one of the largest potential pitfalls for recipients of government funds. The government typically conditions receipt of payments or relief funding on a recipient's certified compliance with statutes, regulations and various other contractual requirements. Making express or implied false certifications to the government may subject businesses or individuals to FCA liability.

Given the massive amounts of stimulus funds the government will distribute, and what will likely be a staggering number of applicants for stimulus relief, the CARES Act's certification provisions are sure to be a primary focus of the government's efforts to pursue participants in the Act for wrongdoing.

Avoiding FCA Liability for False Certifications

All applicants for government funds under the CARES Act must carefully review and understand the conditions of payment tied to receipt of those funds. Submitting claims while in violation of material terms and conditions of payment may lead to FCA liability under a false certification theory. Government contractors should review their contracts for terms that require compliance with the CARES Act and ensure that they are compliant before submitting claims. Applicants for government relief funds, including loans under the PPP, must also review conditions of funding to ensure they are compliant with the CARES Act before claiming or receiving such funds.

For example, small businesses applying for a loan under the PPP must certify that they:

  • are eligible to receive a loan under the rules in effect at the time the application is submitted that have been issued by the SBA implementing the Paycheck Protection Program;
  •  are either (1) an independent contractor, eligible self-employed individual or sole proprietor or (2) employ no more than the greater of 500 employees or, if applicable, the size standard in number of employees established by the SBA for the applicant's industry
  • will use all SBA loan proceeds only for business-related purposes; and
  • are not engaged in any activity that is illegal under federal, state or local law.

Small businesses--and their affiliates--seeking funding through the PPP loan program must comply not only with the certifications on the loan application, but also existing SBA rules and regulations. Both small businesses and large businesses should be wary of the SBA's affiliation rules when applying for funding through the CARES Act's SBA loan program.

Companies should also consider the risks posed to the directors and officers responsible for a company availing itself of government funding, such as through the PPP, particularly those who certify compliance with government requirements. If an individual is suspected to have certified the submission of a false claim on behalf of an applicant, the certifying person may face an investigation by the Office of the Inspector General of the SBA examining whether their conduct violated the FCA.

In addition to the specific certifications required from small businesses under the PPP, any applicant for stimulus funding, under any provision of the CARES Act, should be careful, particularly in the heightened urgency of the early stages of administration of the relief package, not to unilaterally decide to forgo any other government requirements (e.g., mandated procedures, tests, certifications and so forth) that may be applicable, unless there is explicit written government authorization to do so.

Companies should also be careful to document the rationale and bases supporting their submissions (including, for instance, communications with the government or others in the industry, advice of counsel, etc.) and should document any governmental modifications or waivers of requirements are authorized in writing by a government official or agency with sufficient authority to act (i.e., by the contracting officer, or by an authorized government agency). Companies should ensure that they have effective reporting systems in place to receive notification of potential compliance issues and then investigate them sufficiently. In FCA investigations, government investigators have traditionally viewed a failure to maintain records as tantamount to an admission, and record keeping problems due to COVID-19 may not be enough to mollify federal investigators two or three years in the future. Just as no two clients have identical needs, Civil Investigative Demands issued by the DOJ vary based on myriad factors. However, in order to successfully navigate a future investigation by the SBA-OIG and the DOJ, we recommend that businesses keep the following categories of documents for ten years:

  • records and communications relating to the application, award and performance of SBA loans;
  • employment and invoice records--to defend against allegations that employees or subcontractors were receiving money without performing their concomitant duties; and
  • any contracts or agreements that the SBA loan recipient has with agents or affiliates.

As the government continues to roll out stimulus payments and other relief, it is essential that recipients of government funding have a plan in place to ensure they comply with all applicable regulations and requirements to avoid potential FCA liability down the road.