Paycheck Protection: capital was easy, intake was hard

The week

The Paycheck Protection Program, created by the CARES Act, opened to applications from small businesses and sole proprietors on April 3, 2020, with independent contractors and self-employed individuals eligible from April 10. Private lenders made the loans, the Small Business Administration guaranteed them, and forgiveness was available if funds were used for payroll and certain other costs. In the first week, lenders faced very high demand, frequently updated guidance from SBA and Treasury, and outages and slowdowns in SBA’s E-Tran system for submitting loans. Some large banks initially limited applications to existing customers. That week the Federal Reserve announced a facility to provide liquidity to lenders against PPP loans, releasing its terms on April 9.

The Paycheck Protection Program put private lenders between the federal government and millions of small businesses. Funding was the easy part, because the SBA guarantee and the Federal Reserve facility took care of it. Lenders hit their limits elsewhere, in three operational stages: taking in applications, verifying what the program and existing law required, and submitting loans to SBA and funding them. Each stage fell on a different part of the workforce, and each showed what really sets an institution’s capacity when volume arrives overnight.

Intake: a flood of applicants and documents

Small business lending at most banks and credit unions is relationship-based and paced by loan officers. PPP brought in many times the usual volume of applications within days, often with payroll documents in inconsistent formats. Institutions without a digital intake channel fell back on email and shared drives. That was unmanageable within days, and it moved payroll records and tax documents through ordinary inboxes.

Institutions with digital account opening or online lending platforms adapted them, sometimes with fintech partners. Others built simple web forms and document portals in days. A workable intake design had four elements: a structured application form, a document upload tied to the application, an automatic acknowledgment with a reference number, and a queue that showed each file’s status. Without the status queue, applicants called branches to ask, and branch staff could not answer.

Staff from branches, wealth management and operations were redeployed to review files. Redeployment worked only where the work had been broken into simple steps that people from other roles could perform. A checklist for completeness, a second-level reviewer for exceptions, and a short daily briefing on guidance changes turned generalists into productive reviewers within a day or two.

Verification: what lenders still had to check

SBA guidance let lenders rely on borrower certifications for many program requirements, such as payroll amounts and the necessity of the loan. It did not suspend Bank Secrecy Act and anti-money laundering obligations. For existing customers, lenders could generally rely on the due diligence already performed. For new customers, they had to collect and verify customer and beneficial ownership information in the usual way.

That distinction explains why some large banks initially limited applications to existing customers. New customers needed onboarding work that existing customers did not, and onboarding teams were already stretched. Compliance teams had to write and keep updating procedures as SBA issued interim final rules and frequently asked questions, sometimes several times in a week. Version control for procedures turned into a real control. Each file needed to show which guidance applied on the date it was processed, so that later reviews could judge it fairly.

Fraud screening sat in the same stage. Basic checks, such as matching the business to public registrations, confirming the account holder’s identity, and comparing claimed payroll with deposit history, could run in minutes for existing customers. They were slower for new ones. Every lender had to decide how much verification to run before funding, knowing that speed was the program’s purpose.

That decision is better made explicitly than by default. A lender can set tiers: existing customers with clean histories proceed on certification plus automated checks, while new customers or files with mismatches go to a reviewer before funding. Writing the tiers down, and recording which tier each file followed, gives the institution a defensible position when auditors, SBA reviewers or prosecutors later examine individual loans. It also tells redeployed staff exactly when to escalate.

Submission and funding: the government system as bottleneck

Every loan needed an SBA loan number through E-Tran, which was not built for the volume. Outages and slowdowns meant staff worked through the night to submit when the system was available. Larger lenders later submitted in batches through automated interfaces, while many smaller lenders continued to key loans one at a time.

Throughput depended on the slowest system in the chain, which was not the lender’s own. Queuing with automatic retry, clear status for each application, and a reconciliation between approved, submitted and funded loans mattered as much as underwriting speed. Funding added its own checks: confirming the deposit account, booking the loan in the core system, and generating the note and disclosures. Each handoff was a point where a file could stall unnoticed.

Remote work made all three stages harder. Reviewers at home needed secure access to document repositories, a fast way to escalate questions, and clear rules for handling customer documents outside the office. Institutions that had already moved operations staff onto laptops and cloud collaboration tools redeployed people in a day. Those still tied to desktop workstations and paper files spent the first week on logistics.

The pattern across the stages is consistent. Capacity in a surge comes from standard steps, simple tools, current procedures and visible status. Institutions that treat surge capacity as a designed capability, with a playbook and trained reserve staff, can reuse it for fraud spikes, system conversions and remediation work.

With hindsight

The first round of funding was exhausted on April 16, 2020, and Congress added more within days. The program ran in further rounds into 2021, and forgiveness processing created a second operational wave as lenders reviewed applications and submitted them to SBA. Community banks and credit unions made a large share of the loans, and many gained business customers who had been turned away elsewhere.

The fraud that followed was substantial. In 2023 the SBA Office of Inspector General estimated that more than $200 billion in pandemic-era EIDL and PPP funds may have gone to potentially fraudulent actors. Reliance on self-certification, high volumes and pressure for speed all contributed. The trade-off lenders faced in April 2020, between getting money out quickly and checking who received it, remains the central design question for any future emergency lending program.