The Paycheck Protection Program (PPP)— Congress’s signature small business relief program in the historic Coronavirus Aid, Relief, and Economic Security Act (CARES Act)— was rolled out in early April to immediate, overwhelming demand and weeks of questions and controversy. Borrowers quickly soaked up its initial $349 billion, leading Congress to authorize an additional $310 billion in funding in late April. Subsequent months saw continued interest and controversy, with Congress stepping in multiple times both to loosen restrictions on various aspects of the program and to extend its application deadline and forgiveness windows. 

The PPP has been an experiment unprecedented in scope and scale, based on federally-backed, forgivable loans to small businesses distributed through private lenders. According to recent reports, nearly 5,500 PPP lenders have issued nearly 5 million loans totaling $518 billion in funds. Due to its rapid, unprecedented, and untraditional nature, there continues to be interest from various quadrants on lenders and borrowers, including from regulators and law enforcement, plaintiffs’ attorneys, Congress, and the press. This article addresses the areas for potential enforcement or litigation activity to watch for lenders, particularly FinTech lenders that have participated in the program. Because of their especially high volume of lending activity, FinTech lenders should stay attuned to these developments.



As noted above, Title I of the CARES Act created the PPP, which authorized billions of dollars in forgivable loans for small businesses. Under the program—administered by the US Small Business Administration (SBA)—qualified private lenders lend to eligible businesses (generally those with under 500 employees) under a streamlined application and underwriting process. Eligible borrowers, in turn, can obtain forgiveness of the loan amount by submitting an application to the lender providing certain information, including certifications that the applied-for forgiveness amount was used for eligible purposes (principally maintaining payroll). The precise requirements surrounding eligibility and forgiveness have been subject to various regulatory and legislative updates and enactments—as well as litigation—in the months since the passage of the CARES Act. 


To date, there have been nearly 5 million individual loans issued pursuant to the program by almost 5,500 lenders, totaling over $518 billion. Although banks with over $50 billion in assets have played a prominent role, issuing 36% of the total dollar amount in loans, smaller lenders have been the most active. Over 5,300 of the individual lenders have been banks with less than $10 billion in assets, issuing over 2.5 million loans for a total of approximately $231 billion—accounting for 44% of the total funds expended pursuant to the program. 

FinTech lenders have also played a significant role in the program. According to Federal Reserve data, FinTech lenders were the biggest source of loans in 2019 for small businesses with medium and low credit profiles. For the PPP, less than two dozen FinTech lenders were responsible for issuing over 166,000 loans and distributed a total of $4.7 billion, issuing almost 8,000 loans per lender, the highest number for any category reported on by the SBA. News reports have also highlighted how one smaller bank generated a significant volume of PPP loans partnering with FinTech companies for loan origination.[1]


The PPP is subject to numerous forms of government oversight, giving PPP borrowers and lenders good reason to stay informed on the latest developments in the space.


The CARES Act itself designates the SBA as principally in charge of enforcement and oversight of the PPP, including an appropriation of an additional $25 million for the SBA Office of the Inspector General. The SBA has indicated it will engage in audits of certain borrowers (e.g., those seeking forgiveness for loan amounts above $2 million). Given the large size of the program and the limited resources at SBA, it is anticipated SBA’s oversight may be stretched thin with respect to oversight. 


With the loosened requirements for borrowers, expansive scope, and the attractiveness of forgivable loans, early commentators predicted that PPP would be a “playground for fraud.”[2] The Department of Justice has announced over twenty criminal prosecutions for fraud committed under the program, all of which pertain to borrowers who made false representations in their applications in order to obtain PPP funds for their own personal use.[3]


The CARES Act provides for the Offices of Inspector General (OIGs), including SBA as mentioned, to take an active role in overseeing and enforcing the Act’s requirements and rooting out fraud, waste, and mismanagement. To further these efforts, the CARES Act created a new Pandemic Response Accountability Committee (PRAC) charged with overseeing the federal government’s entire response to the COVID-19 pandemic, including all funds distributed pursuant to that response. In addition to conducting its own audits and reviews, including with subpoena power, PRAC coordinates among the various OIGs. Thus far, PRAC has created a website that allows the public to track the distribution of COVID-19- related funding, has issued three reports of its own, and has compiled OIG reports from other agencies related to the COVID-19 pandemic response. 


Pursuant to Section 5(a) of the Federal Trade Commission Act (FTCA), the FTC is empowered to file a complaint and civil investigation against businesses that engage in “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45.  

The Federal Trade Commission (FTC) has already exercised its authority to police PPP activity. Early on, the FTC filed a complaint related to the PPP, and it has also issued warnings to several other companies. On April 17, 2020, the FTC filed suit against a financial services company that provides assistance to small businesses and assists them in applying for SBA loans. See Federal Trade Commission v. Ponte Investments, LLC et al, No. 1:20-cv-0017 (D.R.I.). In that suit, the FTC alleged that the company deceptively represented itself as a lender under the PPP when it was not. Shortly after the FTC filed suit, it entered into a settlement agreement in which the company agreed to disclose that it was not a lender in the program.

On two other occasions, the FTC has issued warning letters to other companies for engaging in similar practices. On May 18, 2020, the FTC announced that it was sending warning companies to two companies because their “marketing would lead consumers to believe they are affiliated with the SBA, or that consumers can apply on their sites for loans through” the PPP. The websites included claims like “Your Paycheck Protection Program Loan starts here!” On June 24, 2020, the FTC and SBA sent similar warning letters to six other online companies. In each case, the FTC directed the companies to take immediate action to remove such claims. 


The Consumer Financial Protection Bureau (CFPB) may also engage in enforcement efforts. To date, the CFPB has only issued general guidance related to the PPP, including statements encouraging compliance with the Equal Credit Opportunity Act (ECOA)—which prohibits discrimination in lending—and providing a portal for small business owners to submit complaints online if they believe they were discriminated against based on race, sex, or other protected category.[4] The agency’s most recent fair lending report in April 2020 focused to some degree on discrimination and small business lending.[5]


In addition to federal regulators and agencies, there is potential for state enforcement actions initiated by state attorneys general or state consumer protection or banking regulators. All 50 states have a statute that prohibits various forms of unfair and deceptive practices, in most cases modeled off the FTC Act.


Preexisting regulators of federal and state chartered banks—such as the Federal Reserve, FDIC, and the Office of the Comptroller of the Currency (OCC)—have jurisdiction over the safety and soundness of banking practices and have oversight over lenders’ administration of their PPP lending activities. Thus far, the OCC has issued guidance stating that banks are not required to obtain or maintain information for PPP beyond what exists in the ordinary course of business, but encouraging banks providing loans under the PPP to prudently document their implementation and lending decisions. [6]


The PPP has already subjected lenders (and the SBA) to waves of private litigation, in a variety of areas


Early on, a PPP lawsuit was brought against Bank of America (BofA) for allegedly imposing its own eligibility requirements, beyond those provided for under the CARES Act, on PPP borrowers. See Profiles, Inc. v. Bank of Am. Corp., No. CV SAG-20-0894, 2020 WL 1849710, at *1 (D. Md. Apr. 13, 2020). The plaintiffs alleged that by imposing certain requirements, such as requiring the borrower to have a pre-existing lending account with BofA, the bank was prioritizing its larger, pre-existing customers. But the court denied the plaintiffs’ requested relief and held that the CARES Act did not authorize a private right of action for borrowers to sue private lenders, and that the Act permitted banks to impose their own lending requirements. Many similar suits have followed. In some of these, the plaintiffs have asserted claims under the Sherman Act, 15 U.S.C. § 4, and other state law claims—such as state consumer protection laws, which may provide a more flexible standard—instead of attempting to bring claims under the CARES Act. 


More recently, lawsuits have been filed across the country by accounting firms and others alleging that lenders violated of the CARES Act and various state laws by not paying “agent fees” to plaintiffs who allegedly assisted borrowers in filling out and submitting PPP loan applications. The gist of these suits is that, in implementing the PPP, the SBA allegedly required lenders to pay fees to agents who assisted in facilitating borrower loan applications. There have been over a dozen such lawsuits filed in various courts across the country, and plaintiffs in several of the cases have moved to consolidate the cases before the Judicial Panel on Multidistrict Litigation. 

Treasury Secretary Mnuchin was asked about the agent fee litigation in recent testimony before Congress. In a hearing before the House Committee on Financial Services, Secretary Mnuchin stated that he would consider issuing more guidance to clear up “any confusion” about whether banks were required to pay agent fees to accounts and others, and noted that the guidance that was issued stated “that banks could pay agent fees out of the fees that they received,” and that it “was intended to be based upon a contractual relationship between the agent and the bank.” 


Although the prior two categories of lawsuits constitute the large majority of suits filed against private lenders, there have been other types of suits as well. These include cases about covenants in existing loans. In early May, hotel operators in several states brought declaratory judgment actions in New York and Florida federal courts, seeking a ruling that their participation in PPP would not trigger prohibitions on additional indebtedness in other, pre-existing loan agreements, because the forgivable PPP loan should not constitute “debt.”[7] Shortly after filing suit, the creditors agreed to allow the plaintiffs to participate in the PPP notwithstanding existing loan documentation, and the plaintiffs dismissed the lawsuits voluntarily. 

Securities litigation has also begun. In Guofeng Ma v. Wells Fargo & Co., et al., the plaintiff filed a securities class action against Wells Fargo pursuant to Sections 10(b) and 20(a) of the Securities Exchange Act and Rule 10b5, alleging that Wells Fargo and its leadership made false and misleading statements by failing to disclose that Wells Fargo planned to improperly allocate their PPP lending, causing its stock price to fall. Id., No. 3:20-cv-03697 (N.D. Cal.) (filed Jun. 4, 2020).


FinTech lenders have largely been spared from the above-described legal proceedings thus far. Given its enormous size, however, the litigation and enforcement landscape for PPP is still in its early stages. As forgiveness applications begin— and with information about PPP lending now being disclosed more widely—public scrutiny over the lending program will only grow. 

We foresee a few main areas of likely focus for FinTech lenders. 

First, over the past several years, the Fintech industry has faced scrutiny from state regulators and the CFPB. Those regulators have pursued consent orders, enforcement actions, and investigations concerning an array of companies in the FinTech space, including those engaging in lending. Many of these actions have been based on broadly worded unfair and deceptive acts and practices (UDAP) authority shared by state regulators, the FTC, and the CFPB (whose authority also includes “abusive” practices). The breadth of enforcement authority over practices deemed unfair, deceptive, or abusive, investigation makes it a potential tool for regulators of activity in this space. 

Another area of focus may be fair lending. Some public reports have claimed that minority-owned businesses may have had more difficulty obtaining PPP loans or have received a low proportion of total funds from the SBA program.[8] As relevant to the FinTech space, regulators have highlighted the potential for the use of artificial intelligence in lending decisions as a potential concern for discriminatory impact.[9] Thus, the use of algorithms, machine learning, or similar tools may raise fair lending considerations for lenders to remain attuned to. 

In addition, FinTech lenders should consider the possibility for litigation by private plaintiffs similar to those already pending and discussed above. Further, with more information in the pipeline to be disclosed to the public about lenders and borrowers’ participation in the PPP, new varieties of lawsuits are likely to arise. Ultimately, the precise nature of lawsuits that will be filed in the future may be difficult to predict, but with hundreds of billions of dollars of volume, it is likely that PPP litigation will arise and last for some time. Due to their prominent role in the program, FinTech lenders should be prepared for this eventuality.