Down Arrow Button Icon

There is a “significant risk” of fraud for Paycheck Protection Program loans, the Government Accountability Office (GAO) said Thursday, urging the Small Business Administration to ramp up efforts to respond to such risks.

In a report released Thursday, the government watchdog, which is charged with overseeing spending for the CARES Act, said that “Because of the number of loans approved, the speed with which they were processed, and the limited safeguards, there is a significant risk that some fraudulent or inflated applications were approved,” the GAO said. “In addition, the lack of clear guidance has increased the likelihood that borrowers may misuse loan proceeds or be surprised they do not qualify for full loan forgiveness.”

The GAO said the SBA had limited safeguards in place and has not provided details on “how it plans to identify and respond to risks in PPP,” and urged the administration to develop more oversight plans to ensure the program’s integrity and address possible fraud. The office acknowledged that while the SBA has set up some safeguards, it has “provided limited information on how it will implement” them.

The $670 billion program was set up quickly to give small businesses emergency loans of up to $10 million that could be converted into grants, but the process has been chaotic from day one. Borrowers have struggled with quickly changing guidelines and rules from the administration that made the process (and applying for forgiveness) confusing for many.

The GAO noted that, given how quickly the administration needed to disburse funds, the SBA allowed lenders to “rely on borrower certifications to determine borrowers’ eligibility, raising the potential for fraud.” The SBA has said it will review loans over $2 million, but the government watchdog said that as of June 15, the administration hadn’t provided details on “how it planned to carry out that work, and it had not provided information on oversight plans for the more than 4 million loans of less than $2 million each.”

Meanwhile, the office maintained the SBA to date has “failed to provide information critical to our review, including a detailed description of data on loans made.” In contrast, the GAO said, “most agencies were generally able to provide GAO timely access to information for this report while executing their responsibilities during this unprecedented national crisis.”

Indeed, the GAO has been trying to procure more information from the SBA for weeks. In response to the report, the SBA said in a letter that it had indeed provided documents to the GAO and made staff available for meetings, and maintained it was “not accurate” to say the administration hadn’t planned for proper oversight, among other comments. In a separate statement following the report, Jennifer Kelly, a spokeswoman for the SBA, said “Unfortunately, the report minimizes the historic work that SBA has undertaken to implement the CARES Act and mischaracterizes SBA’s engagement with GAO.” The SBA also said in the statement “While providing emergency economic relief to millions of small businesses nationwide, SBA made senior officials available for interviews with GAO and produced hundreds of pages of documents to GAO. SBA, while carrying out work that is unprecedented in scope and scale, prioritized providing information that GAO expressly asked for and information that directly responded to GAO’s questions. SBA continues to provide additional information to GAO on a rolling basis.”

After weeks of mounting pressure, the SBA and Treasury announced on Friday the agencies would be providing more details for loans of over $150,000, including the names and business addresses of borrowers. However, loan amounts would only be disclosed in ranges, up to the $10 million cap. Based on the most recent data from the SBA, the vast majority of the over 4.7 million borrowers would remain unnamed.

Now, the GAO’s report likely confirms what lenders, lawyers, and experts have long assumed. Indeed, the “significant” risk for fraud isn’t surprising to many involved in the program.

Kevin Cohee, the CEO of OneUnited Bank, a PPP lender, recently told Fortune the bank had to work through “a lot” of fraudulent applications for PPP loans: “That was one big part of the challenge. That might be the biggest drain on the [bank’s] resources.”

Others including lawyers have long noted the risk for fraud was high for the program. “There will be fake companies, and there will be people doing fraudulent things, and no bank wants to be the one that approved that [application],” Maria Earley, a financial services regulatory and enforcement partner at international law firm Reed Smith, told Fortune back in April, days after the program began.

Thus far, the Justice Department has already brought cases against several PPP borrowers, accusing them of fraud.

Update, June 27: This article has been updated with a comment from the SBA.