---
title: "'We Are Not the Fraud Police': How Fintechs Facilitated Fraud in the Paycheck Protection Program — Section III.C–III.F (Womply, 'Paths of Least Resistance,' Kabbage, and Bluevine)"
body: U.S. House of Representatives, Select Subcommittee on the Coronavirus Crisis (Majority Staff Report, Chairman James E. Clyburn)
date: 2022-12-01
document_type: Congressional staff report (company-specific investigative findings — verbatim extract)
source_url: https://coronavirus-democrats-oversight.house.gov/sites/evo-subsites/coronavirus-democrats-oversight.house.gov/files/2022.12.01%20How%20Fintechs%20Facilitated%20Fraud%20in%20the%20Paycheck%20Protection%20Program.pdf
press_release_url: https://coronavirus-democrats-oversight.house.gov/news/press-releases/clyburn-fintech-fraud-ppp-doj-sba
extraction_note: >
  This file captures the company-specific findings of Section III of the report that a prior
  extract truncated mid-Section III (the document-extraction web service consistently cut off at
  page 37, the end of the Blueacorn subsection III.B item 9). The full PDF was retrieved and
  converted with pdftotext; the verbatim text below covers Section III.C (Womply), Section III.D
  ("Paths of Least Resistance" — criminal gangs targeting Womply and Blueacorn), Section III.E
  (Kabbage), and Section III.F (Bluevine). Footnote reference numbers (superscripts in the
  original) appear inline as plain digits at the ends of sentences. Page-break markers and figure
  captions are preserved where they appear. Quotations are reproduced verbatim from the source PDF.
---

# Section III.C — Womply's PPP Fraud Screenings Failed to Prevent "Rampant Fraud"—and Were Accompanied by Questionable Business Practices—Despite Generating Over a Billion Dollars in Profits

Multiple high volume PPP lenders relied on Womply to review PPP applications for eligibility and potential fraud, even though the fintech lacked prior experience in conducting high volume small business lending, managing large scale financial crime compliance, or creating scalable automated fraud prevention technology.

Communications obtained by the Select Subcommittee show that some of Womply's partners—who collectively issued over $16 billion in PPP loans in 2021—accused the fintech of referring to them hundreds of thousands of PPP applications containing "rampant fraud."389 Throughout the PPP, many of Womply's closest business partners questioned its fraud prevention capabilities—in one case describing the fintech's technological systems as "put together with duct tape and gum."390

This ad hoc system resulted in Womply referring applications with "obvious[ly] fraudulent" supporting documentation and led the fintech to become one of the "paths of least resistance" for those looking to commit PPP fraud.391

## 1. Lenders Paid Womply $2 Billion in SBA Processing Fees to Review PPP Applications for Fraud and Verify Applicant Eligibility

Womply, also known as Oto Analytics, Inc., was founded in 2011 as a provider of reputation management, email marketing, and business intelligence services for small businesses.392 Womply's leadership team, led by Founder and CEO Toby Scammell and Co-Founder and President Cory Capoccia, were deeply involved in all aspects of the fintech's operations during the PPP.393

The fintech—which had never before involved itself in loan processing or high volume fraud prevention screening—began its involvement in the PPP in April 2020 as a referral agent.394 In this role, Womply created a website through which small businesses seeking a PPP loan could input their personal information that Womply would, in turn, submit to a lender.395 Upon receipt of the referral, lenders would conduct all other tasks associated with processing, managing, and tracking the PPP loans, including verifying borrower identity and auditing borrowers.396

Womply entered into referral agent agreements with ten lenders or platforms and ultimately referred approximately 7,000 PPP loans totaling $360 million in taxpayer dollars while acting as a referral agent. The average amount of these loans was approximately $52,000.397 In 2020, Womply received just under $3 million from lenders for its referral services.398

Beginning in February 2021, Womply initiated a "PPP Fast Lane" service, which it claimed would provide PPP lenders with technological, marketing, underwriting, pre-qualification review, eligibility verification, and other services.399 PPP lenders Harvest Small Business Finance, LLC ("Harvest"), Benworth Capital Partners, LLC ("Benworth"), Fountainhead SBF LLC ("Fountainhead"), DreamSpring, and the Sunshine State Economic Development Corporation used Womply's PPP Fast Lane service.400 These five PPP lenders, to whom Womply provided both referral and LSP services, collectively issued over a million PPP loans (totaling more than $16 billion) in 2021.401

In a presentation to Select Subcommittee staff, Womply explained that, as part of its new PPP Fast Lane service, the fintech's staff (1) conducted automated eligibility checks; (2) identified and verified their PPP borrowers' identities through automated and manual KYC management; (3) conducted automated and manual bank and tax document analysis to confirm PPP program eligibility; and (4) implemented automated and manual anti-fraud tools and measures to detect application fraud, in service of BSA requirements.402 Applicants that passed Womply's pre-qualification reviews were then forwarded to one of its partner lenders. According to information obtained by the Select Subcommittee, PPP loan applicants submitted a total of over 3.7 million applications in 2021 through Womply, with most likely going through their PPP Fast Lane program.403 Of that 3.7 million, 70 percent, or 2.58 million applications, were sent to lenders after passing Womply's pre-qualification reviews and underwriting processes.404

In March 2021 alone, Womply referred 889,275 PPP loan applications to lenders.405 In April 2021, Womply's busiest month, the fintech referred over 1.2 million PPP loan applications to lenders.406 In just one week of that month, the fintech reviewed, processed, and referred over 375,000 PPP loan applications.407 Ultimately, over 1.3 million PPP loans that went through Womply—out of the 2.58 million that Womply referred to lenders—were funded.408 By the end of the program, Womply reviewed and referred approximately $16 billion in taxpayer dollar-funded PPP loans.409 Womply claimed that the services it provided were "crucial to the success" of the PPP.410

Womply's lending partners that participated in its PPP Fast Lane program told the Select Subcommittee that they relied on the fintech to weed out ineligible and fraudulent PPP applicants. Harvest—which was referred more than 800,000 PPP loan applications by Womply—told the Select Subcommittee that "Womply assured Harvest that it would only refer to Harvest complete applications that Womply's platform had confirmed were for eligible borrowers."411 In a conversation with Select Subcommittee staff, Harvest's Managing Director and Chief Operating Officer Adam Seery said that Harvest understood that "Womply's system had checkmarks that would check every part of eligibility requirements. At the point when [the PPP application] came to us, the loan should be ready to go."412

Womply lending partner Fountainhead told the Select Subcommittee that Womply was a "super loan agent" that it believed had the ability to "use some technology to do a lot of the KYC and AML type mechanisms that were clearly spelled out as part of PPP guidelines."413 Similarly, Womply lender Benworth, which received over 400,000 PPP applications from Womply, also relied on the fintech to review PPP loan applications.414 According to Benworth, "Womply handled eligibility verification and fraud prevention in connection with hundreds of thousands of PPP applications referred to Benworth by Womply."415 Benworth told the Select Subcommittee that the "key service" that Womply provided was "verifying—on the basis of such information and documents—[a PPP] applicant's eligibility for a PPP loan" and that a "primary reason why Benworth contracted with Womply was [PPP] Fast Lane and its ability to identify ineligible applicants and stop fraud."416 Benworth also told the Select Subcommittee that it relied on Womply to prevent fraud related to identity theft and the use of fake documents by using its systems to validate a PPP applicant's identity, authenticity, and type of documents submitted, calculations for the PPP loan amount, and bank account information, among other underwriting services.417

Agreements between Womply and its lending partners obtained by the Select Subcommittee reveal that Womply often took at least half—and in some cases up to 90 percent—of all the taxpayer-funded fees allocated to lenders by SBA to compensate it for processing PPP loans.418 Under these agreements, Womply was entitled to fees both for referring applicants to PPP lenders and for providing its PPP Fast Lane pre-qualification review, eligibility verification, and fraud detection services.419 According to Womply, the vast majority of its revenue—$1.9 billion in 2021—was "PPP Technology Service Revenue" from the PPP Fast Lane.420 Additionally, multiple Womply contracts contain provisions that imposed "Under-Funding Fees" that required lenders to pay Womply additional funds as a penalty for failing to fund a certain value of PPP loans in a calendar week.421

## 2. As Womply Pushed Lenders to Fund as Many PPP Loans as Possible, Its PPP Lending Partners Observed That the Company Had Poor Processes and Was Approving a Large Number of Seemingly Fraudulent Applications

### a. Womply's PPP Lending Partners Expressed Concern About the Quality of the Company's Fraud Screenings, with One PPP Lender Accusing Womply of Referring PPP Loan Applications with Missing Documents and "Obvious Fraudulent Information"

In a conversation with Select Subcommittee staff, the CEO of Fountainhead—one of Womply's major lending partners—described the PPP Fast Lane as "kind of put together with duct tape and gum."422 The lender said that, despite Womply having developed the system specifically to process PPP loans, "I don't think [Womply's] system was built to handle the workload it was put under" and that "there were always problems with their system in terms of tech glitches."423

Womply lending partner DreamSpring also expressed concern about Womply's pre-qualification review capabilities and repeatedly stated that the fintech was referring obviously fraudulent PPP applications. In a March 20, 2021 email, DreamSpring's Chief Lending and Client Experience Officer notified Womply that some of the applications that the fintech referred to the lender, mostly from Florida, had "a bunch of fraud."424 In a March 30 email to Mr. Capoccia, DreamSpring's Chief Operations and Innovation Officer told Womply that the fintech had referred PPP applications containing "[t]ax returns with obvious fraudulent information."425 DreamSpring also told Womply that the fintech had referred "[applications] with no [t]ax return attached" as required.426 In the same email, DreamSpring's Chief Operations and Innovation Officer stated that the company was "still seeing some important issues come up during our review" of the PPP applications referred by Womply and that the lender wanted to have a discussion with Womply to "see how [we] can work together to mitigate the risk of receiving more volume with errors…"427 In a March 31 email, DreamSpring told Mr. Capoccia that "we need to address [these errors] asap."428

On April 13, 2021, Mr. Capoccia pressed DreamSpring to fund more PPP loans. Mr. Capoccia asked DreamSpring's Chief Operations and Innovation Officer by email if the lender would "increase your daily [PPP] funding amounts closer to the $20m/day that we originally discussed a while back?"429 In response, DreamSpring's Chief Operations and Innovation Officer again stated that Womply was sending the lender ineligible and likely fraudulent loans:

> Yes we can but are having difficulty doing so because we continue to find applications that ARE NOT eligible to fund. As you know, we are fully responsible and hold all the risk associated to the loans. To answer your question, the only way we can get there is if we can be reassured that everything in our pipeline is completely eligible.430

In that email, DreamSpring informed Womply that it would "be providing a list of DUPLICATE names/apps, from a very small sample, we have just found today which are evidently fraudulent loans" as evidence of the large amount of ineligible loans that the lender was receiving from Womply.431 In the same email, DreamSpring's Chief Operations and Innovation Officer described the impact that their referral of "evidently fraudulent loans" had on the lender's operations and explained that failures in Womply's screening processes, which were still occurring in mid-April 2021, slowed down the funding of PPP loans:

> All of this prompts us to review larger samples of the loans Womply is providing and thus slows down our process. I am sure you understand that impedes us from funding loans blindly in large volumes. I hope you understand and we will continue to fund on a daily basis as much as we can while we mitigate potential risks to DreamSpring. Everything that is eligible in the pipeline will get funded. The $20m was based on the assumption that we would not be having to review larger and larger samples of applications.432

The CEO of PPP lender Lendistry—a fintech which itself issued over $4.7 billion in PPP loans in 2021—also expressed concerns to Womply and its lending partner Harvest regarding their fraud prevention and screening processes and asked for details on the companies' fraud mitigation processes. On June 8, 2021, Lendistry's CEO emailed Mr. Scammell and Harvest's Mr. Seery:

> We have noticed a meaningful increase in the number of third-party and other inquiries related to fraud associated with applicants coming through Harvest. Can you confirm that your team is focused on making sure these issues are resolved and provide us with a written summary or other documentation of your team's fraud mitigation processes?433

Mr. Seery, adding Mr. Capoccia to the email chain, responded by asking for "specific examples of what you are seeing on your end" and stated that he would "connect with Womply and our accounting team to review and investigate."434

### b. Benworth—Womply's Second Largest PPP Lending Partner—Criticized the Fintech for Referring Applications with "Rampant Fraud"

The Select Subcommittee obtained a series of May 2021 emails between Womply and Benworth, the fintech's second-largest PPP lending partner, in which Benworth's senior leadership expressed serious concerns about Womply's fraud prevention and eligibility verification program capabilities.435 These emails show that, in late April and early May 2021, Womply discovered what Benworth described as "rampant fraud" in the over 200,000 PPP loan applications Womply had referred to Benworth.436 Subsequently, Benworth became concerned that Womply's application screening processes were inadequate and had exposed it to "a dangerous amount of liability."437 On May 10, 2021, Benworth's CEO wrote to Mr. Scammell and Mr. Capoccia:

> Over the last several days, it has become clear that the services promised by Womply, have not only not been provided, but have also placed our company in a very bad predicament due to the high likelihood of fraud involved in many of the referred loans from your company. We relied on the promises and representations made by Womply, as to the validity and legality of the referred loans, when we entered into the agreement, yet it has become clear…that Womply is unable to perform as agreed to.438

Benworth wrote that banks involved in disbursing PPP loans referred by Womply had previously voiced concerns about the high incidence of fraud in Womply-reviewed loans.439 On May 7, 2021, Benworth's CEO wrote to Mr. Scammell and Mr. Capoccia: "We are managing our banking relationship very closely because they are anxious with the amount of fraud they are seeing. Bluntly stated, we have been on the brink of being closed 3 times."440 Benworth's CEO told Mr. Scammell: "I have given our bank assurances that we have every protocol in place to mitigate fraud. Now it seems that may not be the case."441

In a May 10, 2021 email, Benworth's CEO alleged that Womply had "misrepresented (either willfully or negligently) its ability to perform [PPP application review services]" and had improperly excluded Benworth from the fintech's communications with the SBA and SBA OIG concerning fraud.442 Prior to that, on May 7, 2021, Benworth's CEO wrote:

> What happened to the systems you had in place that you were so quick to remind me of yesterday? Are they no longer good enough? Have the services provided and promised by Womply not as reliable as had been promised therefore requiring changes? Should we be worried about the 200,000 loans already funded through the use of your Company's systems?443

In an earlier email to Benworth, dated April 8, 2021, Womply proposed changes to its pre-qualification, fraud prevention, and other screening processes to better address fraud.444 Those changes included increased manual reviews and sending an email to PPP applicants stating that "they should not attempt to commit fraud through [Womply]."445 Womply told Benworth that such a warning would "minimize casual fraud."446 However, in a May 10 response, Benworth's CEO characterized Womply's new proposed fraud review process as "unproven" and "last minute,"447 and pointed out that these changes would not detect fraud in the 200,000 loans that Womply had already referred to the lender.448

In a letter to the Select Subcommittee, Benworth stated that it had multiple concerns with Womply's performance, and had "many discussions" with Womply about the fintech's performance.449 For example, Benworth discovered documentation errors, and "[i]n the final weeks of PPP, Benworth discovered that Womply was not providing Benworth with the applicants' supporting documents in many of the packages being submitted."450 Benworth further stated that its concerns with Womply's performance grew towards the end of the PPP as "Benworth also started receiving complaints—and even some subpoenas—relating to loans referred by Womply."451 Benworth's CEO had earlier warned Womply that the fintech's activities left both companies exposed to criticism or penalty after the PPP ended, cautioning, "When the party is over and the lights turn on, we [Benworth] will be the only ones at the party (and it seems standing naked)."452

## 3. Womply's CEO Has a History of Unethical Behavior, Including a Conviction for Criminal Fraud That May Have Warranted His Exclusion from SBA Programs, Including the PPP

The SBA may prohibit entities from participating in its 7(a) lending program due to a history of unethical or illegal conduct—including debarments and prior convictions for fraud.453 Mr. Scammell—who served as Womply's CEO and ran its fraud prevention operations—was previously convicted of financial crime and barred from the securities industry.454 Despite this, Mr. Scammell's company was allowed to oversee the distribution of billions of dollars of taxpayer funds, with Mr. Scammell serving as the highest ranking Womply executive that had "responsibilities related to the KYC process and anti-fraud measures implemented by Womply for the Fast Lane Program."455

In 2009, Scammell was charged with stealing proprietary and confidential information from his girlfriend related to a potential merger between Disney and Marvel Entertainment, and trading on that information using bank accounts belonging to his brother.456 On August 11, 2011, the SEC filed a civil action alleging that Mr. Scammell engaged in unlawful insider trading through that conduct.457 On June 15, 2012, Scammell consented to the entry of a permanent injunction prohibiting him from participating in the securities industry.458 On April 21, 2014, in a parallel criminal case, Mr. Scammell pleaded guilty to "'knowingly and with intent to defraud' engag[ing] in a fraudulent scheme" related to insider trading and was sentenced to three months of imprisonment and $120,000 in restitution, in addition to the $801,000 he was to pay under a civil settlement with the SEC.459

In its opinion regarding the case, the SEC noted "the high degree of scienter involved in [Mr. Scammell's] offense and his intentional acts of concealment," and concluded that "there is a significant risk that, given the opportunity, he would commit further misconduct in the future."460 Further, the SEC determined that "Scammell's misappropriation of material, nonpublic information for his own personal benefit and profit demonstrates that he is unfit to take on such heightened responsibilities in any capacity in the securities industry."461

The SEC stated that Mr. Scammell provided misleading information regarding Womply in the course of their 2011 investigation, noting that Mr. Scammell "tried to impede the [SEC's] investigation through a lack of candor in responding to the staff's questions," and that Mr. Scammell continued his dishonest behavior even after his civil and criminal punishments.462 The SEC wrote that, "[d]espite Scammell's consent to an injunction, it is questionable whether he has learned anything or has been 'chastened and deterred' as a result of his prior conduct."463

The SEC also observed that "Scammell's financial condition is [] closely tied to the financial condition of Oto Analytics and Womply" and accused Mr. Scammell of lying to federal regulators about Womply's financial condition in an attempt to frustrate government's efforts to determine the appropriate amount of monetary relief owed in the underlying civil injunctive action.464 Additionally, according to the SEC, Mr. Scammell also improperly used Womply investor funds for his personal legal defense.465

Mr. Scammel's criminal history may have constituted good cause for the SBA to revoke or suspend Womply and Mr. Scammell's privilege to conduct business with the SBA. Rules contained in 13 C.F.R. § 103.4(f) allow the SBA to revoke the right to participate in SBA programs any entity found to be "engaging in any conduct indicating a lack of business integrity or business honesty, including debarment, criminal conviction, or civil judgment within the last seven years for fraud, embezzlement, theft, forgery, bribery, falsification or destruction of records, false statements, conspiracy, receiving stolen property, false claims, or obstruction of justice."466 Mr. Scammell's permanent injunction prohibiting him from participating in the securities industry and criminal conviction may have also constituted good cause to disallow Womply from participating in SBA 7(a) programs in 2020 and 2021.

## 4. On Multiple Occasions, Womply Resisted Providing Information to Support SBA OIG Investigations into Pandemic Relief Fraud and Was Criticized by the SBA OIG and the SBA for Its Behavior

Despite purportedly working on the PPP program in an effort to help the federal government provide relief to American small businesses, Womply declined requests to help the federal government prevent fraud in the program and ensure that loans were going to only eligible Americans. Beginning in May 2021, Fountainhead—which was the lender of record for a group of Womply-referred PPP loans under investigation—and the SBA OIG repeatedly requested that Womply provide information to aid the SBA OIG in an investigation into potential fraud related to those loans.467 According to internal emails provided to the Select Subcommittee, Womply declined to provide this information for at least two months. Mr. Scammell (copying Mr. Capoccia) wrote to Fountainhead and the SBA OIG to state that the company would not comply with the SBA OIG's requests.468

A month after its initial request for PPP loan applicant data, an SBA OIG official emailed Fountainhead stating: "Can you please make the below request to Womply again?" and stated that "Womply should be providing this information to it's [sic] lenders…"469 Fountainhead, following the SBA OIG's direction, again pleaded with Womply for this information, writing on June 10, 2021, "[w]e are dependent on Womply for the research data being requested by the U.S. Small Business Administration, which is being requested so that the SBA can investigate potential fraudulent loan activity carried out by PPP borrowers."470

Despite this plea, that same day, Mr. Scammell responded to Fountainhead and the SBA OIG and declined their request for information to aid the SBA OIG's PPP fraud investigation. In that email, Mr. Scammell stated that Womply would not "agree to undertake the substantial work involved in researching and packaging the requesting information" unless Womply was paid additional money "pursuant to a new contract [that] would be subject to our a la carte list of technology service fees for research requests."471

Mr. Scammell, on behalf of Womply, also stated that the fintech would not provide the requested information to aid the SBA OIG investigation because "Womply is not interested in contracting with Fountainhead for such purposes." Womply claimed that it was not obligated to assist in the SBA OIG investigation because "Womply is not a lender—it is a technology provider with no existing contractual relationship with either SBA or Fountainhead."472 Womply even claimed that it was "inappropriate for Fountainhead to direct SBA OIG information requests to Womply."473

Mr. Scammell's refusal on Womply's behalf to assist in the SBA OIG investigation drew a response from both Fountainhead and the SBA. One day later, Fountainhead's COO responded to Mr. Scammell, arguing: "The status of Fountainhead's relationship with Womply should not have any impact on the OIG agents' requests, which were initially forwarded to [Mr. Capoccia] over a month ago."474 On June 16, 2021, the SBA again requested information from Fountainhead regarding two loan files. In response, Fountainhead's COO directed the SBA request to Womply's "Contact Us" page and suggested that the SBA may need to subpoena Womply for the information.475 A senior litigation counsel for the SBA contacted Mr. Scammell directly in response, asking "What is going on here?"476 In her email to Mr. Scammell, she described the importance of Womply providing the files and the impact that the fintech's resistance to doing so would have on fraud prosecutions and innocent borrowers:

> [I]t appears [that Fountainhead] are unclear as to whether they can obtain PPP files from Womply. This is unacceptable. I have dozens of both active fraud cases that need to be either referred to the IG/DOJ or cleared so that borrower loans can be forgiven. SBA and borrowers will be harmed if Fountainhead and/or Womply cannot provide assurances that the Agency will have timely and continually access to PPP loan documentation…
>
> Please confirm that Womply will assist Fountainhead in complying with SBA file requests in a timely fashion. And of course, please confirm that Womply is not requiring SBA to issue subpoenas for PPP files.477

In a conversation with Select Subcommittee staff, Fountainhead confirmed that the lender had "difficulties getting complete loan files out of Womply" in response to requests from federal investigators.478 Fountainhead said that the lender was forced to get "a temporary restraining order against [Womply], so they can't destroy these [PPP loan] documents."479

Womply also resisted providing data to Benworth to assist an SBA OIG investigation. On April 27, 2021, an SBA OIG official requested from Benworth electronic copies of loan files and IP address information related to a PPP borrower in connection with an investigation.480 Benworth provided the loan files but informed the SBA OIG official that Womply held the requested IP address information.481 On May 17 the SBA OIG requested these files directly from Womply.482 Womply declined to provide the information to Benworth and directed the SBA OIG to fill out a web form on the "Contact Us" section of Womply's website.483

In response to Womply's refusal to provide the information to Benworth, an SBA OIG official wrote directly to Mr. Scammell stating that "Womply should be providing the lender the related loan information for any related loans associated with the requesting lender" and making clear to Womply that their response was "not acceptable protocol for SBA / SBA OIG when a request was made to an SBA Lender."484 By June 17, 2021, Womply still had not provided the information that the SBA OIG requested.485

Separately, on June 11, 2021, the SBA formally warned Womply that the fintech was potentially engaged in "unlawful or unethical activity" related to its acceptance of PPP loan applications after the PPP deadline and described information on Womply's home page as "misleading."486 Specifically, Womply's website indicated that the fintech was still accepting PPP applications although the PPP had ended weeks earlier.487 The SBA warned Womply that the fintech had "currently no authority…to accept PPP applications" and warned that Womply should not be "accepting PPP loan applications, charging applicants fees for submitting PPP loan applications (if applicable), or collecting personal information from applicants."488 The SBA wrote: "Womply's continued acceptance of PPP applications may constitute unlawful or unethical activity as provided for in 13 CFR part 103, et seq."489

## 5. Lenders and SBA OIG Officials Accused Womply of Leveraging Its Close Connection with the Trump Administration's SBA to Convince Lenders of Its Reliability

Harvest's Adam Seery told Select Subcommittee staff that he was under the impression that Womply "had their own direct tie ins to the SBA and Treasury" and that "one of the big reasons we decided to partner with [Womply] was because of the interaction they were having directly both with Treasury and SBA."490 SBA rules warn that entities that claim or imply special connection to SBA officials may be engaged in unethical behavior.491 According to Harvest, "Womply, both to Harvest and publicly, represented it was capable of performing this service because of its close association with the SBA."492 Harvest also noted that "Womply indicated that it was working directly with Bill Briggs, head of the Paycheck Protection Program at the SBA [during the Trump Administration], to ensure the [PPP Fast Lane] program was meeting all of the SBA's requirements."493

In early 2021, Mr. Scammell and Mr. Briggs hosted an online seminar on the PPP. In one Facebook ad, Womply said, "We teamed up with Bill Briggs from the Small Business Administration" to "answer your PPP burning questions."494 Mr. Scammell also texted Mr. Briggs directly. In a text message obtained by the Select Subcommittee, Mr. Scammell asked Mr. Briggs if he would participate in "two more high profile livestreams next week: one on Instagram and the other on LinkedIn" and speculated that he could "get hundreds of thousands of viewers."495

> Figure 5: Womply CEO Toby Scammell in a joint virtual appearance with Trump Administration SBA Official Bill Briggs.

An SBA OIG staff member told the Select Subcommittee that they first became aware of Womply because "we were starting to get a lot of contacts from financial institutions who were starting to get [PPP loan payments] into people's personal bank accounts for people they knew did not own their own business and a lot of returned funds were [originated by lenders] using these companies BA [Blueacorn] and Womply."496 In a briefing with the Select Subcommittee, an SBA OIG staff member said that Mr. Scammell was "trying to position himself to utilize his communications with SBA and SBA OIG" as "propaganda to get more lenders to partner with Womply."497 According to SBA OIG staff, Mr. Scammell also appeared to have misrepresented his relationship to the SBA and SBA OIG: "I'd talk to lenders and they'd say [Scammell] says he's coordinating with SBA. I'd say 'I've seen that communication and that's not what's happening.'"498 When asked about the usefulness of the information that Mr. Scammel provided regarding potential fraud, the SBA OIG staff told the Select Subcommittee: "I can't say for certain that the stuff Womply sent over was specifically utilized."499

The SBA OIG staff recalled that, in April 2021 conversations between the SBA OIG, Harvest, and Fountainhead, "Womply said [to their lenders] they had spoken to SBA about what they were doing and what they are doing is appropriate for the program,"500 and that Womply "was selling propaganda to the lenders claiming [Mr. Scammell] had communications with SBA, or OIG, or other law enforcement saying that what was happening in his programs was catching the fraud."501 Although senior Trump Administration officials collaborated with Womply on outreach efforts, Biden Administration officials had a different interaction with Mr. Scammell. A Biden Administration SBA official told the Select Subcommittee that Mr. Scammell "was hoping to get support from SBA to build new contractual relationships with other lenders and certainly that's not what we do. We just listened and took notes. I wouldn't say we used any of the information he provided."502

## 6. Despite Windfall Company and Owner Profits, Womply and Its Executives Received Millions of Dollars' Worth of Taxpayer-Funded PPP Loans

According to internal company financial information obtained by the Select Subcommittee, in 2021, Womply's total net revenue was $2.09 billion, gross profit of $1.8 billion, constituting an 87.6 percent profit margin.503 This financial information shows that Womply's operating expenses were $160 million and "other income expenses" were $379 million.504 Womply's total net income was over $1.3 billion.505 By contrast, in the last pre-pandemic year for which the Select Subcommittee has figures, Womply was unprofitable, losing $11 million.506

Despite this windfall, Womply, using the name Oto Analytics, Inc., was approved to receive $5.1 million in PPP loans from taxpayers.507 Mr. Capoccia, in his role as Womply's President, signed the application for the fintech's 2020 PPP loan.508 In a potential conflict of interest, these PPP loans were approved by Harvest, the entity that would become Womply's most important PPP business partner.509 In Womply's second PPP loan, received shortly before it began working on the PPP, Mr. Scammell and Mr. Capoccia corresponded directly with Harvest senior executives, including close business partner and Harvest Managing Director Adam Seery, in securing the multi-million-dollar loan for Womply.510 Womply's second loan was for $1,999,997, just three dollars below the threshold for receiving heightened scrutiny by the Treasury Department, which had announced in May 2020 that it would not audit PPP loans under $2 million.511

On August 19, 2021, Mr. Scammell signed Womply's PPP Loan Forgiveness Application Form for its first PPP loan.512 On September 10, 2021, he signed the company's PPP Loan Forgiveness Application Form for the second PPP loan.513 On September 1, 2022, the SBA informed Harvest that both of the PPP loans it had approved for Womply were denied forgiveness.514 According to the SBA Denial Justification letter obtained by the Select Subcommittee, both loans issued to Womply and approved by Harvest were later determined to have been ineligible. In a letter to Harvest, the SBA explained that it "determined that [Womply] was ineligible for the PPP loan amount" that it received in the first draw.515

The SBA further "conclude[d] that the documentation provided [by Womply was] insufficient to support forgiveness" and noted that "[m]ultiple requests were made for documentation to determine eligibility and not all requested information were provided."516 The SBA further noted that, by virtue of Womply being ineligible for its first draw PPP loan, the company was also ineligible for the second draw PPP loan.517 As such, the SBA is now requiring that Womply pay back the PPP loans that it received, in full.518

> Figure 6: Loans Received by Mr. Scammell, Mr. Capoccia, and Womply (d/b/a Oto Analytics).519

Womply declined to disclose to the Select Subcommittee full details of its ownership structure, including the percentage of the company that Mr. Scammell and Mr. Capoccia owned.520 However, according to a PPP application submitted by Womply to Harvest, as of 2020, Mr. Scammell owned 18 percent of Womply, and Mr. Capoccia owned five percent.521 Based on the ownership percentages presented in Womply's PPP application, Mr. Scammell may be entitled to as much as $324 million of the taxpayer funds paid to Womply for its involvement with the PPP, and Mr. Capoccia may be entitled to take $90 million, assuming a $1.8 billion gross profit.

Womply owners Mr. Scammell and Mr. Capoccia also received separate PPP loans for themselves or their other companies. Mr. Scammell received a PPP loan for himself through his single member limited liability company, Chasm LLC.522 Mr. Capoccia also received two personal PPP loans through Womply's partners with at least one facilitated by Womply.523 Despite receiving over $400,000 in salary from Womply, including a nearly $160,000 bonus and up to $324 million in profits, in 2021, Mr. Scammell received taxpayer forgiveness for his PPP loan.524 Mr. Capoccia received forgiveness for his loans despite receiving over $400,000 in salary in 2020, including $150,000 bonus and potentially millions in additional profits.525

The Select Subcommittee offered Mr. Scammell and Mr. Capoccia an opportunity to speak directly with the Select Subcommittee to discuss potential waste, fraud, and abuse in the PPP.526 Both Womply executives declined. Mr. Scammell, through his counsel, told the Select Subcommittee that he was unavailable to speak to the Select Subcommittee, either in person or virtually, at any time this summer, because he was in Europe.527

## 7. Womply May Have Given the Sensitive Personal Information and Private Business Data of Millions of PPP Applicants to Its New Business to Market and Sell Additional New Products to PPP Loan Recipients

Mr. Scammell, Mr. Capoccia, and other Womply executives founded Solo Global, Inc. in 2022, after their work on the PPP concluded.528 The company, for which Mr. Scammell serves as President, markets a mobile application and other financial and marketing services to small businesses.529 On May 20, 2022, Womply updated its privacy policy to notify PPP applicants who had previously applied for PPP loans through Womply that Womply's (retroactively) updated terms gave Solo Global, Inc. the right to use the personal data of PPP loan applicants for its own purposes, "including, but not limited to, improving their products and services and marketing their products and services to you."530 This change gave Mr. Scammell, Mr. Capoccia, and their new business access to "over 2 [million] tax documents, over 1.5 [million] bank accounts from applicants, and over 1 [million] completions of various KYC/CIP/KBA inquiries," from small businesses and sole proprietors who had used Womply to apply for federal relief benefits.531

In their privacy policy update, Womply notified PPP applicants that the fintech would share their names, email addresses, phone numbers, bank account numbers, full credit card numbers, IP addresses, geolocation data, tax return details, social security numbers, income and wage information, information about bank account balances (including current and available balance), and professional information (including information about a PPP applicant's employer), among other highly sensitive information to their new for-profit business venture.532 As a result, the sensitive personal and business data of anyone who applied for a PPP loan through Womply is now available to Solo Global, Inc. and can be used to further Mr. Scammell and Mr. Capoccia's business interests.

Personal information submitted to government agencies, including the SBA, is typically protected by the Privacy Act of 1974, which places limitations on federal agencies' use and disclosure of data on individuals that is controlled by federal agencies.533 However, although the SBA's application form for PPP borrowers cited Privacy Act protections for borrowers,534 the Privacy Act may not have applied to private entities such as fintechs where they were neither supervised by the SBA nor contractually obligated via government contracts to comply with the Act.535

The Select Subcommittee asked Womply for details as to how PPP applicant information was being used. In response, the fintech referred the Select Subcommittee to its May 20, 2022, privacy policy,536 and declined to answer questions regarding what PPP information was given to Solo Global, Inc. and how the new company was using or intended to use the sensitive personal information of over a million pandemic relief applicants.

## 8. Womply Claimed to Be a "Technological Service Provider" to Avoid Accountability for Its PPP Actions, Despite Likely Meeting the Definition of an LSP

Womply has described itself as a "technology service provider," despite performing functions usually associated with LSPs, and has used its purported status to avoid accountability. Evidence obtained by the Select Subcommittee indicates that Womply likely should have been considered an LSP and therefore been subject to SBA regulation. While Womply did provide some technology services, its core functionalities appear to closely resemble the SBA's criteria for an LSP.

The SBA defines an LSP as an entity "who carries out lender functions in originating, disbursing, servicing, or liquidating a specific SBA business loan or loan portfolio for compensation from the lender."537 The Select Subcommittee obtained evidence showing that multiple PPP lenders delegated functions in originating, disbursing, and servicing loans to Womply.538 Further, the SBA specifically states that individuals or entities who "[p]erform any pre-qualification review based on SBA's eligibility and credit criteria or the 7(a) Lender's internal policies prior to submitting the Applicant's information to the 7(a) Lender[,] or [p]rovide to the 7(a) Lender an underwritten application, whether through the use of technology or otherwise," "meet the definition of an LSP."539 Evidence further indicates that Womply independently conducted pre-qualification reviews on PPP applications based on SBA and lender criteria before referral to lenders.540

When SBA OIG asked for Womply's help in an investigation into a potentially fraudulent loan, Womply told the SBA OIG and a lending partner that the fintech was not obligated to assist the investigation, asserting: "Womply is not a lender—it is a technology provider with no existing contractual relationship with either SBA or Fountainhead. As such, it is inappropriate for Fountainhead to direct SBA OIG information requests to Womply."541

Womply used the same reasoning to avoid responsibility for approving fraudulent loans through its PPP Fast Lane service. In a letter to the Select Subcommittee, Womply claimed that, as technology service provider, it was "not subject to the Bank Secrecy Act or any of its anti-money laundering ('AML') program requirements" and that it was "not a Lender Service Provider subject to SBA regulations."542 Had Womply been designated as an LSP, it would have been subject to SBA regulations and required to follow rules set forth by the SBA that governed LSPs, including the potential exclusion of LSPs with a criminal history of fraud, such as Mr. Scammell.543

Womply, in a lawsuit against Capital Plus, emphasized that its status as a "technology service provider" meant that the company should be treated differently from lenders' "agents" that provide loan application preparation and referral services. Womply also stressed that its status as a "technology service provider" meant that it was not subject to any SBA caps on how much money the company could take in SBA processing fees.544

Benworth similarly accused Womply of miscategorizing itself as a "technology service provider" in order to secure higher shares of taxpayer-funded fees. According to Benworth, Womply, "taking advantage of its superior bargaining position," tried to "mask[] the lender service provider [] relationship the companies enjoyed."545 Benworth stated that Womply, by improperly categorizing itself as a "technology service provider," was able to demand a payment structure that would lead to "Benworth pay[ing] Womply more than 90% of the total fee collected" from certain PPP loans.546

## 9. Womply's Largest Partner—Harvest Small Business Finance—Took Home Millions in Profits While Delegating Anti-Fraud Measures to Womply and Conducting Little Oversight of Their Fraud Controls

Womply reviewed, processed, and referred 800,000 applications to Harvest.547 Harvest estimates that it ultimately submitted 600,000 of these PPP applications to the SBA.548 Prior to partnering with Womply, Harvest relied on a manual process to review PPP loans.549 In a briefing with Select Subcommittee staff, Harvest's COO estimated that its PPP loan review process took approximately half an hour per loan, and that Harvest funded approximately 5,200 loans through this process in round one of the PPP.550 After contracting for Womply's PPP Fast Lane services, Harvest used Womply to review loan applications in later rounds of the PPP.551

As an SBA lender, Harvest was required by SBA regulations to "exercise[] day-to-day responsibility for evaluating, processing, closing, disbursing, servicing, liquidating, and litigating its SBA portfolio."552 These requirements existed despite Harvest's delegation of these functions to Womply. Harvest initially reviewed "a sample" of the loans Harvest was submitting, but ceased its manual spot-checks early in their PPP processing relationship.553 Harvest also did not perform any formal audits, assessments, or evaluations of Womply.554 Instead, Harvest relied on Womply's assurance "that it would only refer to Harvest complete applications that Womply's platform had confirmed were for eligible borrowers."555

Harvest was unable to provide to the Select Subcommittee a breakdown of its total budgets for, and amounts allocated to, AML, BSA, eligibility verification, and fraud compliance in 2019, 2020, and 2021, claiming that it "did not create separate budget line items for the amounts allocated to the activities listed."556 Nor do minutes obtained by the Select Subcommittee from meetings of Harvest's senior leadership reflect any analysis, estimates, or discussions concerning the risk of PPP fraud.557 Moreover, Harvest told the Select Subcommittee that it did not have any logs or other documents recording any manual reviews it conducted of Womply loan applications and that it did not maintain records of either the number of Womply-referred applications that it reviewed or the number that it suspected were fraudulent or ineligible.558

Harvest's failure to allocate resources to fraud prevention was not for lack of funds. Harvest's nearly $1.2 billion in 2021 gross receipts—earned in large part because Womply processed loans for Harvest at such a large scale—amounted to nearly 18 times Harvest's gross receipts from 2020.559 Between 2020 and 2021, Harvest increased its operating expenses by only $14 million—an increase of about 40 percent on its prior operating expenses, but a comparatively small slice of its billion-dollar fee income.560 Harvest paid over $350 million in distributions directly to its owners in 2021 alone (with over $225 million going to its majority member, a private equity fund, and nearly $42 million going to each of Harvest's other three members).561 The 2021 distributions represented more than five times the amount of Harvest's entire gross receipts in the year 2020.562 Minutes from members' meetings also show that Harvest's owners discussed early in the PPP plans to pay down the majority member's debt with PPP program profits.563

---

# Section III.D — Fintechs Such as Womply and Blueacorn Were the "Paths of Least Resistance" for Criminal Gangs and Fraudsters Looking for PPP Loans

Fraudsters on the dark web swapped tips about how to successfully commit PPP fraud and identified fintechs as the "paths of least resistance," according to an SBA OIG official who spoke to Select Subcommittee staff.564 Specifically, individuals looking to commit fraud identified Bluevine, Blueacorn, and Womply as "fintechs with lower fraud risk capabilities that were letting a lot more fraud go through."565

An independent fraud researcher analyzing Telegram-based fraud rings came to the same conclusion. The researcher noticed "thousands and thousands of post[s] – all of them boasting about defrauding Womply's PPP loan program."566 In a May 2021 website post entitled "Is Womply [] Getting Whomped With PPP Fraud?", the researcher wrote: "Scammers were posting a flurry of messages about 'Womply' PPP loans and how easy it was for them to scam the service and get fraudulent loans."567 Womply communications obtained by the Select Subcommittee show that the fintech knew that it was a top target for fraud. In May 2021, Mr. Scammell wrote: "We're seeing an increase in the sophistication of attacks and our team is also picking up significant dark web activity surrounding SBA, EIDL, PPP (including Womply and other technology companies)."568

Womply- and Blueacorn-facilitated PPP loans were crucial to one violent drug dealing enterprise in central Florida.569 Police and media reporting show that gang members allegedly created limited liability companies, solicited individuals through social media, and, in some cases, stole identities to apply for PPP loans, which were then approved.570 Investigators believe the PPP loans were then used to finance the criminal enterprises, including the purchase of guns and drugs.571 Police documents allege that the gang members quickly identified Womply and Blueacorn as easy targets to obtain PPP loans without much scrutiny.572

In conversations intercepted by law enforcement as part of their investigation into narcotics trafficking, an Army Gang member spoke about the ease of using Womply to obtain fraudulent PPP loans. In a phone call, the Army Gang member was recorded explaining how Womply works and trying to recruit others into his PPP fraud scheme. The Army Gang member explained to an unidentified associate that Womply was popular with fraudsters, stating that "everybody in the 'hood'" was using Womply.573

In one group conversation with multiple gang members, a member of the Army Gang stated that he specialized in using Womply to get fraudulent PPP loans, while another gang member stated that he used Blueacorn for fraud.574

At one point, an Army Gang member sent a screenshot to the group chat of a successful deposit into a bank account related to an earlier fraudulent Womply PPP loan. Despite using both Blueacorn and Womply, some members of this criminal gang preferred Womply "because it was quicker" at processing PPP loans.575

---

# Section III.E — The PPP's Structure Did Not Incentivize Kabbage to Implement Strong Fraud Prevention or Develop a Robust Loan Servicing Apparatus

Before the pandemic, Kabbage was an Atlanta-based fintech with a valuation of $1.2 billion that specialized in financing underserved small businesses and individuals.576 Founded in 2009, Kabbage both ran its own lending operation and offered an automated platform to other lending businesses.577 Beginning in April 2020, Kabbage participated in the PPP through partnerships with banks and as a direct lender in its own right.578 Kabbage signed contracts for round one of the PPP to market, process, and service PPP loans for two banks, Cross River and Customers Bank.579 However, Kabbage has said that even at the height of its bank partnerships, it was the direct lender for over half of its PPP loan volume.580

Kabbage facilitated over 310,000 PPP loans over the course of the PPP.581 Loans by Kabbage featured heavily in PPP fraud prosecutions. An October 2020 Project on Government Oversight report identified Kabbage as one of the four top lenders for loans that the Justice Department had alleged to be fraudulent.582 A joint investigation by the Miami Herald, McClatchy DC, and the Anti-Corruption Data Collective also found that about 20 percent of the PPP loans they identified as suspicious in 2020 were approved by Kabbage.583

Many Kabbage loans contained indicators of fraud at the time of application. As noted below, a ProPublica report found that Kabbage sent 378 PPP loans worth $7 million to purported farms that were questionable on their face, including an orange grove in Minnesota and a cattle ranch based on a New Jersey sandbar.584 The Miami Herald reported that Kabbage facilitated a loan of between $350,000 and $1 million to a Florida company registered three months after the date that would qualify them to participate in the PPP. They also reported that between $150,000 and $300,000 in loans to companies in Louisiana were registered just days before making their loan application and operated by a borrower with delinquent SBA loans, in violation of PPP lending rules.585 High-profile prosecutions involving Kabbage loans—such as a May 2022 prosecution of the actor who played the Red Power Ranger in the Mighty Morphin Power Rangers television and film franchise—have continued into 2022. Prosecution documents state that these applications contained red flags such as business names that differed across various support documents for the same loan.586

## 1. The Program's Full Guaranty for Loans and Lender Payment Structure Likely Disincentivized Kabbage from Rigorously Rooting Out Fraud

Documents obtained by the Select Subcommittee indicate that Kabbage was aware of weaknesses in its fraud prevention systems, but that it nevertheless reduced its primary fraud staff and implemented a system that confused and concerned employees and financial institutions. The company's internal communications raise questions about whether Kabbage approved loans with markers of potential fraudulent loans without doing adequate due diligence. Although the SBA issued a rule holding lenders harmless for borrower ineligibility, lenders were nevertheless required to follow standard BSA requirements, including verifying borrower identities—which Kabbage repeatedly failed to accomplish.

### a. Kabbage Was Aware of Fraud, but Had Little Incentive to Prevent It

Kabbage executives were aware of the risk that fraudulent PPP applications would pass through the company's systems. In the first months of the program, Kabbage hired a consulting firm, Alvarez & Marshall Disputes & Investigations, LLC (A&M), to conduct a review of its work on the PPP. A&M's testing, concluded by June 11, 2020, indicated that one of ten Kabbage-approved loans tested by A&M had failed its automated test to verify business identity and recommended that the applicable procedures "should more clearly account for [a] process" to handle such failures.587 A&M also found that three of ten approved applications tested were missing one or more required supporting documents.588 The report noted that "Kabbage is currently in the midst of enhancing controls."589 But, at the time of that statement, Kabbage had already funded over 120,000 loans through the prior control system.590 Despite these issues, the assessment concluded that "[o]verall," Kabbage's program complied with the limited SBA rules and applicable regulatory standards.591

By July 2020, internal emails among Kabbage executives indicated that Kabbage had seen significant increases in fraud by businesses applying for PPP loans (first-party fraud), including through falsified tax documents that had been auto-approved without any manual input. For example, a series of applications from a fraud ring using forged W-3 forms for identical loan amounts across multiple applications had passed all of the automated screenings Kabbage had in place, but were caught by banks receiving the funds.592 Kabbage introduced plans in the same month to use additional reviews for higher-value loans and new controls to flag suspicious documents.593 By that time, however, Kabbage had already funded over 160,000 PPP loans totaling nearly $5 billion.594

At least one exchange suggests that the program's structure incentivized Kabbage to deprioritize rigorous fraud reviews. In a July 2020 internal chat among risk and fraud analysis team members, several Kabbage team members raised concerns about the scope of fraud they were seeing.595 One analyst wrote, "I'm feeling really uncomfortable with the review procedure we have now because I'm not comfortable passing almost all the people I have to pass. . . . I feel like the level of fraud we're reviewing is wildly underestimated."596 Another wrote, "we are also getting a lot of tickets from [initial reviewers] for 'weird looking docs' but if they come back in inscribe [a third-party document screening software] as clear should we just say sorry there is nothing we can do here?"597

In response to an analyst's question about multiple applications coming from a single device, a Kabbage risk manager instructed his team that the fact that "the risk here is not ours—it is SBAs [sic]" should inform their decisions to approve or deny the applications.598 This comment appears to have referred to the full SBA guarantee for PPP loans and the SBA's promise to ultimately "h[o]ld harmless" lenders for borrowers' lack of compliance with program criteria, even though lenders were still required to conduct due diligence on borrower identities consistent with regulatory standards applicable to banks.599

### b. Kabbage Reduced Its Risk and Account Review Staff by 50 Percent While Approving Billions in PPP Loans

Despite the risk of fraud, Kabbage made staffing reductions throughout 2020 that likely weakened its capacity to address fraud. Press reports indicate that Kabbage furloughed employees in March 2020, anticipating a contraction in business during the pandemic, but that participation in the program "saved" the struggling fintech.600 Nonetheless, internal employment data obtained by the Select Subcommittee indicates that, starting May 2020, Kabbage continuously reduced its core staff over the course of many months despite its lucrative participation in the PPP.601 The staff shed by Kabbage included full-time members of the Risk and Account Review teams that were primarily responsible for fraud reviews and KYB/KYC reviews.

By June 2020, Kabbage halved its Risk and Account Review employees from 84 (in April) to 42, and the numbers continued to meaningfully decline through September.602 Despite these staff reductions, Kabbage funded approximately $1.6 billion in PPP loans in May, $1.5 billion in June, and over $800 million in July 2020.603 Kabbage outsourced the work to temporary contractors.604 In an email exchange regarding contractor onboarding, Kabbage executives discussed heavily pressuring these prospective reviewers to prioritize speed by setting "crystal clear [contractual] expectations with them in terms of output per hour so we manage cost/output appropriately."605 A quota system, if it was indeed implemented, would have further incentivized reviewers to ignore indicators of fraud in applications.

### c. Kabbage PPP Application Reviewers Expressed Confusion and Concern About Kabbage's Fraud Controls

In communications obtained by the Select Subcommittee, a Kabbage employee expressed concerns to an executive about unclear or inadequate processes for identifying and addressing potential fraud. The employee contacted Kabbage's Head of Strategy in early July, noting that "it just seems like there is money going out the door to bogus businesses that is preventable." The executive responded that the company should approve questionable loans, stating: "it's a really hard spot we're in with the program . . . . Essentially if there is no definitive proof of fraud (I'm sure there are exceptions to what I'm going to say) then we have to let it through."606 Although the program rules permitted lenders to rely on borrower certifications when analyzing a lender's eligibility for given loan amounts and its use of loan proceeds, lenders were generally required to implement methods to identify and verify new borrowers' identities (or to use a Customer Identification Program operated by certain federally insured financial institutions) and to develop customer risk profiles.607 It is therefore unclear how the executive concluded that lenders "have to let … through" loans they suspected of being fraudulent.

Members of Kabbage's fraud team repeatedly questioned the effectiveness of Kabbage's guidance to its fraud review teams. Internal chats among fraud analysts suggest confusion about the company's formal requirements for fraud prevention. In a June 2020 chat, one fraud team member expressed alarm at the company's lack of clear guidance for red flag escalation, writing: "For real though . . . is this process not all written down somewhere?" and mocked Kabbage's purported "See Something" "Say Something" approach to fraud escalation:608

On June 3, 2020, Kabbage's Head of Portfolio Risk and Analytics instructed fraud reviewers in Kabbage's internal "ppp fraud"-focused chat channel, "We should absolutely not clear any account for Fraud or KYC/KYB until 100% sure . . . it's better to decline if we are not 100% sure than actually approve with 90% confidence."609 However, another supervising risk manager sent contrary instructions to the same chat group on July 16, 2020: "[I]f someone sends in all the docs we have asked for and are not forged, then we need a convincing reason to decline them. Simply 'we think you're fraudulent because you have a device match' does not cut it."610 Kabbage employees responded to the latter advice by requesting "something in writing." Another employee wrote that they wanted written guidance to "cover my rear end" in the event the guidance led them to approve fraudulent applications.611

Concerns about Kabbage's processes extended to the executive level. In late April 2020, several weeks into the program, Kabbage's Chief Technology Officer wrote to other executives: "[W]e need an end to end system. [T]his is a wreck. I don't know what people are reviewing and under what rules . . . . it's crazy to manage this volume in spreadsheets."612 At the time of that discussion, Kabbage had already funded over 50,000 PPP loans.613 Kabbage's antifraud program also lacked governance structures such as a committee focused on fraud and financial crime or minuted leadership meetings on fraud-related issues, even though these would be standard protocols in many similarly situated, directly-regulated financial institutions.614

### d. Multiple Banks Working with Kabbage Raised Concerns About Fraud in Kabbage-Approved Loans, but Kabbage Did Not Appear to Take Steps to Mitigate Those Concerns

A number of banks working with Kabbage—both as lending partners and as recipient institutions for PPP funds—raised concerns about fraud among Kabbage-approved loans.

Both Cross River and Customers Bank stopped working with Kabbage after the PPP's first round. When asked about its experience with Kabbage during the PPP, Cross River indicated that it ended its partnership with Kabbage in August 2020. Among other factors, Cross River described concerns surrounding Kabbage's application reviews, including "process and documentation issues" that made it "a prudent risk management decision not to work with Kabbage during the 2021 PPP."615

Wells Fargo, which processed fund transfers for Kabbage during the first round of the PPP, developed what one Kabbage executive referred to as a "contentious relationship" with the fintech over its approval of fraudulent applications.616 Wells Fargo requested in July 2020 that Kabbage transition to a different bank for its fund transfer services.617 A representative of Wells Fargo wrote to executives at Kabbage on July 17, 2020: "As discussed on the call today, we are concerned about the significant increase in the fraudulent transactions confirmed by Kabbage over the past few days, including $18MM of new transactions that were flagged yesterday."618 Kabbage executives dismissed Wells Fargo's concerns. In a July 17, 2020, exchange, Kabbage's Head of Capital Markets passed along to other Kabbage executives a question from Wells Fargo about whether Kabbage knew about, or informed the FBI about, an applicant who had been arrested after obtaining a PPP loan from Kabbage. The company's Head of Strategy responded internally: "I doubt anyone would ever confirm or deny any of that …. so sure what the hell … we called them." He added: "It's not like we'd be able to comment on anything if we did. I'm not going to even look to see if we filed any reports on that one."619 Kabbage's General Counsel responded to the email chain: "good grief[.] OK you got me it was me – I'm behind [fraudulent applicant] little piglet soap company."620

Kabbage also appears to have failed to address fraud flags raised by recipient financial institutions. On July 31, 2020, a senior vice president for fraud prevention at Citi Bank emailed Kabbage's Head of Strategy with the subject line "Incoming Kabbage SBA Loan to Citibank---Possible Fraud," marked as "High" importance. The executive explained in the email that an incoming PPP loan for $20,833—the maximum available to a sole proprietor—was sent to an individual who did not own a business, and offered: "I have some of the funds still on hold if you guys want them back."621 In a follow up email to Kabbage's Head of Strategy on September 22, 2020, regarding another potentially fraudulent loan, the executive noted: "[U]nfortunately, I wasn't able to hold the funds on the last loan because I never got a response from anyone at Kabbage."622

## 2. The Select Subcommittee's Investigation Confirmed That Suspicious Kabbage-Funded Loans Identified by News Organizations Were Approved Despite Multiple Red Flags

The structure of the PPP, in which the SBA and American taxpayers assumed all the risk, while lenders (and, by extension, their partners) were paid for all loans issued but not for applications reviewed and rejected as ineligible, meant that fintechs like Kabbage were not incentivized to utilize robust anti-fraud systems. The Select Subcommittee obtained previously undisclosed documents revealing failures in Kabbage's fraud checks. This evidence confirms prior reporting by ProPublica and illustrates that the fintech overlooked significant red flags when it approved apparently fraudulent farm loans. The documents show that the improbable locations of the farms were only part of the story—rather, many of the loans included multiple significant fraud indicators.

In one example, "Deely Nuts" was approved for and issued a $20,833 loan (the maximum for sole proprietorships) in August 2020.623 ProPublica previously reported that, although Deely Nuts' principal business was described as "tree nut farming," the business claimed to be located on a sandbar in New Jersey. Loan application documents obtained by the Select Subcommittee indicate that the applicant filed the incorrect tax schedule form for farms624 and also listed the business' Principal Business or Professional Activity Code (a numerical code based on North American Industry Classification System (NAICS) codes) as "999999"—a default number for "Unclassified establishments" (rather than any of the codes under the "Agriculture, Forestry, Hunting, & Fishing" category).625 The application documents also list zero expenses for wages or contract labor or for purchases of supplies that would typically be required to operate a farm.626 The "Cost of Goods Sold" section of the tax documents cite no expenses for "Materials and supplies" or "labor."627 In contrast to the average gross margin of 13.61 percent for farms in the United States,628 data from the Deely Nuts supporting documents indicate a gross margin of 82 percent.629 The Select Subcommittee also determined that the business address listed throughout the PPP Borrower Application Form is that of a beachfront vacation rental cottage in coastal New Jersey.630

Kabbage approved an application for Shaila Big Fresh Oranges in August 2020 for a $17,931 loan.631 ProPublica and other outlets previously reported that the principal business for this applicant was described as "Orange Groves," even while the application listed a business address in Minnesota.632 Documents obtained by the Select Subcommittee reveal additional red flags, including that the purported farm claimed to have a single employee, listed no wages or contract labor on its application, listed no supply purchases within its expenses, used the incorrect tax form for farms, cited a miscellaneous 999999 NAICs code rather than a code appropriate for farms, and included data indicating an unusual gross margin of 84 percent.633 The Select Subcommittee also determined that the business address previously flagged by Pro Publica was a three bedroom, single family home.634

In the case of Strawberry Joseph Schrempp, which Kabbage approved for a loan of $19,829 in June 2020, ProPublica previously reported that the application listed the home of a bank president who denied owning a strawberry farm. Internal Kabbage documents obtained by the Select Subcommittee show that Kabbage flagged the application for a "fake passport" two weeks after it was approved and its SBA note signed for disbursement.635 Despite the disbursement approval, notes on Kabbage's LexisNexis analysis of the application include "Risk Indicators" such as "Unable to verify business name, address, TIN and phone on business records;" "The input business address may be a residential address (single family dwelling);" "Unable to verify phone number;" "The input phone number and input zip code combination is invalid;" and "The input name and address return a different phone number." Nevertheless, the application's "Verification Status" was listed as "Verified."636 A website tracking and analyzing PPP loan data from the SBA notes that "PPP recipients in th[e strawberry farming] industry report an average of 43 employees, 4200% higher than Strawberry Joseph Schrempp's reported 1 employees [sic], and received an average PPP loan of $230,326, 1,062 percent higher than this company's loan of $19,829."637

Many of these patterns—including tax documents not typically used by farms, miscellaneous 999999 NAICs codes, a lack of labor expenses, business addresses for single-family homes in residential neighborhoods, gross margins exceeding 70 percent and sometimes approaching 90 percent, and email addresses using persons' names other than the name of the applicant contact—appeared in the applications of three other purported farms that were reported by ProPublica, including a tomato farm that Kabbage approved for $12,739; a "Wheat farming wheat farming [sic] field and seed production" that Kabbage approved for $20,833; and a "Beef cattle ranching and farming" business (which ProPublica noted had been registered to the home address of the mayor of Long Beach, New Jersey) approved by Kabbage for $20,567.638 Internal Kabbage emails indicate that each of these businesses had been confirmed as fraudulent in March 2021, seven to eight months after the loans were funded, and that Kabbage had failed to recover any of the funds.639

These issues were sometimes accompanied by other red flags, such as loans sought for exactly the amount available through the PPP to sole proprietors. For example, the Ritter Wheat Club application's payroll calculations added up to exactly $20,833, which was the maximum loan amount for a single proprietor with one employee.640 Internal correspondence indicates that Kabbage had discussed whether loans for $20,833 were suspicious as early as May 2020, but that Kabbage's Head of Policy had opined, "I don't think that's suspicious given we're serving these markets, nor do I think it's fraud."641 At that point, Kabbage had already approved nearly 9,000 loans for that amount, collectively worth over $183 million dollars.642

> Figure 7: Google street view of the residential beachfront site of a supposed "Beef Cattle Ranching and Farming" business in New Jersey, on a PPP application approved by Kabbage.643

## 3. Kabbage Sold Its Primary Business to American Express Mid-Program, Capitalizing on PPP Profits While Leaving Legitimate Borrowers Without Effective Assistance with Forgiveness

On October 16, 2020, Kabbage sold the majority of its assets to American Express Company for approximately $850 million.644 The entity currently known as "Kabbage" is now operated by American Express, while what remained of the original fintech was spun off into a business called "KServicing."645 As part of these transactions, the majority of Kabbage's key employees, data, documents, and systems were transferred to American Express.646 However, American Express did not assume the company's PPP liabilities. In communications with the Select Subcommittee, American Express emphasized that the company "expressly did not acquire Kabbage's liabilities arising under, resulting from, or related to Kabbage's historical loan portfolio or the PPP portfolio. Any regulatory obligations or issues related to Kabbage's PPP loans belong solely to Kabbage."647

At the time of the acquisition and spinoff, Kabbage had already issued PPP loans to over a quarter million borrowers that would need ongoing servicing, including for forgiveness processing. Without clear regulatory penalties for poor servicing of funded loans, Kabbage and its new owner left these borrowers to a severely under-resourced company with fewer than 12 full-time employees to help service those loans.648 Although public estimates put Kabbage's PPP fee earnings at over $300 million at the time of the acquisition,649 KServicing was unable to tell the Select Subcommittee how much funding it had at its disposal post-acquisition to provide services to PPP borrowers.650 However, KServicing told the Select Subcommittee that its resources were "limited."651

KServicing also retained only contractual use of American Express' data and systems, to which they had to request access in order to perform forgiveness services for borrowers.652 Public reports detailed borrowers struggling to obtain their second-draw loan funds from KServicing after the spin-off.653 In March 2022, the Miami Herald also reported that Kabbage/KServicing saw the lowest forgiveness rate of any major lender in the first year of the PPP.654

Even after Kabbage was sold and KServicing was left with a skeleton staff, KServicing continued to fund loans. KServicing informed the Select Subcommittee that, following the October 2020 acquisition, only "one Kabbage employee was dedicated full time and exclusively to AML [anti-money laundering], BSA [Bank Secrecy Act], or fraud compliance from October 16, 2020 to May 2021, at which point this employee was transferred to American Express."655 As of mid-June 2021, "[t]here [were] no Kabbage employees that [were] dedicated full time exclusively to AML, BSA, or fraud compliance," although some employees did such work part-time. Kabbage claimed to have contracted a third-party firm to support the part-time employees.656 Nevertheless, Kabbage continued to fund loans; in the time in which Kabbage claimed to have only one full-time anti-fraud employee, Kabbage funded over 50,000 loans within a 13-week period. Loans continued to be funded even after Kabbage lost that employee.657

While American Express obtained Kabbage's assets, KServicing was left with its responsibilities to service borrowers' loans and the portfolio's liabilities, including multiple Department of Justice investigations into whether Kabbage's review of PPP applications was consistent with federal fraud laws, as well as an investigation by the Federal Trade Commission into potential deceptive and unfair practices.658 KServicing eventually filed for Chapter 11 bankruptcy on October 3, 2022.659

Upon filing for bankruptcy, KServicing disclosed that it faced allegations from SBA that it had made excess loan payments to borrowers, as well as accusations from Customer Bank that it had failed to perform required loan servicing.660 In the same filing, KServicing accused American Express, which continues to manage and publicize Kabbage's primary lending business,661 of failing to honor its commitments to provide KServicing with the data it needed to run it PPP business, including access to the platform used by borrowers.662 While Kabbage's sale left the company with fewer staff to prevent fraudulent loans and protect taxpayer dollars, and borrowers with limited assistance with forgiveness servicing, American Express, Kabbage, and its executives were left free from liability and responsibility.

---

# Section III.F — Bluevine Initially Faced Significant Fraud Rates, but Its Longstanding Partners Intervened to Improve Fraud Prevention over the Course of the Program

The story of another fintech, Bluevine, demonstrates that it was possible to reduce the amount of fraud in the PPP with adequate diligence measures.

## 1. Bluevine Attracted and Facilitated Significant Amounts of Fraud Early in the PPP

Bluevine, a fintech headquartered in California, was founded in 2013 to facilitate loans for small businesses. Between its entry into the PPP in April 2020 and the end of the program in May 2021, Bluevine worked exclusively with two preexisting bank partners—Celtic Bank and Cross River Bank. Bluevine estimated that it had facilitated approximately $2 billion in funds for at least 20,000 small businesses over its approximately seven-year pre-pandemic history. Over the course of the PPP, Bluevine assisted in delivering $8.9 billion in PPP funds to over 300,000 small businesses.663 In other words, during its participation in the PPP, Bluevine facilitated over four times the amount of funds it had worked with in its entire prior history, for at least 15 times the total number of businesses it had previously worked with.

As with other PPP facilitators, numerous fraudulent applications passed through Bluevine's systems. In one case, Bluevine approved a loan application for $1.9 million in May 2020 for a Florida man who claimed to operate a scrap metal company employing 69 people out of his home address.664 The purported business had no internet presence, and the application included IRS forms that cited identical information concerning the number of employees, compensation, and federal income tax over four consecutive quarters.665 Another applicant was initially rejected by Bluevine after submitting falsified bank statements in May 2020, only for Bluevine to approve a second fraudulent application, for the same business from the same IP address for $841,000, a week later.666

Fraud rings appear to have singled out Bluevine for its susceptibility to fraud. Court records show that Bluevine allegedly approved applications in May of 2020 even after its systems linked multiple applications to a single IP address, which was later identified as the home address of a fraud ring participant.667 A member of the ring allegedly sent text messages to his accomplices referring to Bluevine by name and complaining on June 5, 2020 that the fintech was "out of cash."668 Another convicted fraudster, who received 17 years in prison for leading a $20 million coronavirus-related fraud scheme, texted a co-conspirator: "10k guaranteed...they don't check for s---...it's all automated," and "I did 7 [applications] last night and 4 of them got email that it's funded...I'm telling you to apply [to] Bluevine."669

Minutes from Celtic Bank's internal Risk Committee meetings obtained by the Select Subcommittee show that loans processed by Bluevine had higher fraud rates than those processed by Celtic acting alone or in conjunction with other partners, including other fintechs or fintech-owned companies.670 As of mid-May 2021, Celtic's analysis of PPP fraud indicated that Celtic had confirmed 1,723 cases of fraud, 1,557 of which were associated with Bluevine-processed loans.671 As shown in figure 8, Celtic's Risk and Compliance Committees also tracked fraud in PPP loans, with fraud statistics broken out by partner fintech. These records show that Bluevine had an estimated gross fraud rate of seven percent, as compared to under five percent for Celtic's direct loans and lower amounts for those loans processed through other fintech partners.

> Figure 8: Celtic's assessment of PPP fraud, broken down by partner, throughout the PPP (as of May 11, 2021).672

## 2. Federally-Regulated Bank Partners Successfully Pressured Bluevine to Improve Its Controls During the PPP, Likely Reducing Fraud

Bluevine worked exclusively with preexisting bank partners to process PPP applications. Both Celtic and Cross River are well-established banks subject to federal anti-fraud regulations, including the Bank Secrecy Act. Each had a history of working with both SBA and fintech companies prior to the pandemic. Celtic had previously partnered with both Bluevine and Kabbage, among others, to provide other lending products, and had been an authorized SBA lender for two decades.673 Cross River, a small bank with 350 employees, had partnered with fintechs such as Bluevine on various products since 2010.674

Because SBA rules—unchanged when largely unregulated fintechs became major players in the PPP—allowed lenders to delegate fraud controls to contractors, these banks appear to have been the primary outside source of accountability for Bluevine's anti-fraud work.675 Bluevine appears to have benefited from the regulated banks' influence both before and during the PPP. By virtue of Bluevine's relationships with the banks, Bluevine's approximately 80 risk and compliance employees already received regular annual training on customer identification protocols and red flags for identity theft before the pandemic.676 The banks' relative success in pressuring Bluevine to improve its controls over time also suggests that the PPP would have benefited from rigorous oversight of entities responsible for fraud controls and/or from rules restricting delegation of anti-fraud controls, in particular, to well-regulated entities. SBA's general lack of direct oversight of third-party service providers,677 in combination with participation by lenders who had varying regulatory obligations and experience and who largely delegated compliance controls to third parties, created varying degrees of oversight by private lenders responsible for their contractors' actions.

Consistent with risk management guidance from the Office of the Comptroller of the Currency (OCC), both Celtic and Cross River appear to have undertaken "due diligence . . . before selecting and entering into contracts" specific to the PPP, rather than "rely[ing] solely on experience with or prior knowledge of the third party as a proxy for an objective, in-depth assessment of the third party's ability to perform the activity in compliance with all applicable laws and regulations."678 The banks also ensured that the contracts "clearly define[d] expectations and responsibilities of the third party."679 Bluevine informed the Select Subcommittee that its bank partners "regularly review and approve Bluevine's compliance and risk policies and procedures, and can direct Bluevine to make changes in these policies, including any underwriting policies, both before engaging Bluevine to provide third-party services and throughout the course of the business relationship."680 Internal correspondence among Bluevine, Celtic, and Cross River indicates that Bluevine made multiple enhancements to its fraud controls over the course of the program in response to requests and pressure from its regulated bank partners. These improvements indicate that the presence of a strong regulatory structure applicable to fintechs or other entities managing anti-fraud controls may have improved fraud rates across the board during the PPP.

By May 2, 2020, Celtic was "originating annual program volumes in mere days," according to internal correspondence among Celtic executives and Bluevine staff.681 Celtic representatives informed Select Subcommittee staff that they discovered more fraud than they had expected in the first round of the PPP, particularly with respect to the submission of manipulated documents by PPP applicants.682

Celtic's formal governance structure assisted it in tracking and acting on fraud that came through Bluevine. From early in the program, Celtic's Compliance and Risk Committees, made up of executives experienced in risk and fraud-detection operations or other aspects of the financial industry, closely tracked actionable information concerning fraud in Celtic-funded PPP loans.683 Materials from this committee show that Celtic tracked the number and value of fraudulent applications, as well as progress on investigations into fraud, broken down by fintech partner to help Celtic track each partners' anti-fraud performance.684

Celtic representatives had ongoing, regular meetings with Bluevine's compliance and risk teams from the beginning of the program, initially on a daily basis and subsequently three times per week, to discuss fraud trends, individual cases, and potential control enhancements.685 Correspondence obtained by the Select Subcommittee confirms that Celtic personnel gauged the effectiveness of Bluevine's fraud controls in real time and pressed Bluevine to enact increasingly rigorous standards.686

Correspondence between Celtic and Bluevine in the first three months of the PPP indicate that Bluevine introduced new software and manual review processes in response to requests or pressure by Celtic, which was actively monitoring its own fraud risk (and by extension, the fraud risks created by its partnerships) to ensure ongoing compliance with anti-fraud statutes applicable to banks. In response to the bank's request, Bluevine also conducted an analysis of the new checks, which indicated that the controls would have caught 78% of previously-approved fraudulent applications had they been implemented earlier.687 Data subsequently collected by Celtic suggests that the fraud incidence in Celtic's loans (the majority of which were originated by Bluevine) began to decline at the time that these fraud prevention measures were implemented.688 These real-time analyses indicate that the bank's active oversight of its fintech partner, consistent with its own regulatory obligations, may have reduced fraud after new controls were implemented.

> Figure 9: Data from Celtic Bank's internal chart of PPP fraud cases per month in all Celtic-funded loans (as of May 11, 2021), indicating a steep decline in Bluevine fraud incidents following the addition of new controls in June 2020 (and again after further changes for the 2021 round of PPP). Although these figures represent all Celtic PPP loans, nearly three-quarters of PPP funds issued by Celtic's PPP funding were ultimately done through Bluevine applications.689

Celtic continued to engage closely with Bluevine on fraud controls throughout 2020 and, in a renewed partnership limited to second-draw loans, into 2021.690 In board materials for Celtic's Compliance Committee in April 2021, toward the end of the PPP, Celtic estimated that Bluevine's 8.54 percent rate of fraudulent loan funds in first-draw loans had declined to a 0.08 percent rate of fraudulent loan funds in second-draw loans based on then-available data.691 Celtic attributed the improvement to "Process Enhancements" including "Increased front-end controls at Bluevine."692

> Figure 10: Events demonstrating the influence of Celtic Bank's oversight of Bluevine's fraud prevention efforts.693

Bluevine's second partner bank, Cross River, also negotiated the authority to review and require changes to Bluevine's fraud policies and procedures.694 Cross River appears to have performed such reviews of Bluevine's fraud controls periodically, including in advance of each new PPP round. In addition to the April 2020 due diligence discussed above, Cross River requested and reviewed a list of enhancements to anti-fraud detection and prevention measures that Bluevine was making in preparation for PPP reopening in 2021.695 Cross River continued to conduct periodic reviews of partners' fraud policies until late in the PPP.696 However, contemporaneous correspondence from Cross River obtained by the Select Subcommittee generally did not reflect the same rigorous and consistent oversight efforts as Celtic's emails with Bluevine. In a briefing with Select Subcommittee staff, Bluevine acknowledged that Celtic was "more hands on" than Cross River with regard to fraud concerns.697 This difference shows how, without direct oversight of third-party service providers by SBA, even experienced and regulated lenders varied significantly in their ability and willingness to supervise the agents responsible for protecting billions in taxpayer dollars from fraud.

Available data indicates that Cross River's comparatively less hands-on approach to its partners may have led it to approve somewhat riskier loans than Celtic, again suggesting that active oversight of the unregulated fintechs may have correlated with reduced fraud risk. The University of Texas graph shows that nearly 20 percent of Cross River's loans had at least one suspicious indicator, as compared to approximately 10 percent of Celtic's (which was below average across PPP lenders).698 Lenders that worked with Blueacorn and Womply who were less than diligent in monitoring their fintech partners had even higher rates of suspicious loans.699 The apparent distinction between Celtic's and Cross River's results suggest that diligent oversight processes (or the relative lack thereof) may have materially impacted the quantity of fraud in the program.

## 3. Bluevine Struggled to Provide Timely QARs, Underscoring That Oversight Was Required to Ensure Unregulated Fintechs Complied with Applicable Rules

In order to file required Suspicious Activity Reports (or SARs)—reports that alerted regulators to fraudulent loans and related patterns—banks relied on Bluevine to investigate potential fraud associated with Bluevine-processed loans and to provide them with Questionable Activity Reports (QARs) summarizing the issues identified.700 Emails and documents reviewed by the Select Subcommittee show that at least one bank had significant difficulty, throughout the program, in obtaining timely cooperation from Bluevine on QARs to meet applicable legal reporting deadlines under the Bank Secrecy Act (i.e., the filing of a SAR no later than 30 calendar days after suspicious activity is first detected701), an issue that did not improve for much of the program.702 This suggests that significant oversight was sometimes required to ensure that fintechs complied with standard regulations for financial institutions, including regulations critical to keeping law enforcement informed about fraud patterns.

Celtic's internal Compliance Committee minutes from early in the PPP flagged that "PPP Fraud has increased QAR/SAR volumes significantly," and noted the "Highest concentration [of SARs] is with Bluevine."703 In July 2020, Celtic emailed Bluevine's Compliance and Risk leadership to reiterate the bank's need for timely-filed QARs within ten days of confirmed fraud.704

> Figure 11: Item in October 2020 deck for Celtic's Compliance Committee, noting late filings of Suspicious Activity Reports to law enforcement, due in part to "[d]elays in reviews by Bluevine."705

These delays continued well into 2021. On March 30, 2021, Bluevine's Vice President of Compliance wrote to Bluevine's compliance and risk teams:

> [W]e have growing concern about the timeliness and completeness of investigations and QARs from Bluevine. … Recently, we have had a lot of back and forth on incomplete QARs and this is putting us behind on our timeframes [for SAR reporting]. … We need to avoid this at all costs because it is a direct violation of law.706

In response to the pressure from Celtic, Bluevine reallocated resources in 2021, including by hiring "an additional full-time employee … to specifically help support PPP fraud reviews."707

Even with heavy oversight by its regulated partner and its apparent success in reducing fraud rates, the "surge in fraud associated with PPP" appears to have overwhelmed Bluevine, causing its partners to miss legal reporting requirements designed to help law enforcement identify, and respond to, fraud in real time. These requirements were even more critical in the PPP, given the speed at which taxpayer funds were spent and the rapidly evolving strategies of criminal fraud rings. This example raises concerns about adequate and full reporting of PPP fraud by other third-party service providers—especially those who lacked experience in filing SARs—who were facing the same fraud surge but may have had less attentive and experienced lending partners.