Compliance Guidance

S SBCI National Standards

Compliance and Oversight for Participating States

[insert date]

Introduction and Purpose

The Small Business Jobs Act of 2010 (Pub. L. 111-240)(the Act) created the State Small Business Credit Initiative (SSBCI) to support State programs that provide lending to, and investment in, small businesses. The SSBCI program builds on new and existing models for state small business programs, including Capital Access Programs (CAPs), loan participation programs, loan guarantee programs, collateral support programs, and state-run venture capital programs.

The purpose of this document is to set forth national standards for the compliance and oversight responsibilities of states, territories, the District of Columbia, and municipalities that have been approved to participate in the SSBCI (herein referred to as Participating States). Section 3009(a)(2) of the Act requires the Secretary of the U.S. Department of the Treasury (Treasury) to establish minimum national standards for Approved State Programs¹. Section 3004(b)(4)(B) of the Act and Section 4.6 of the Allocation Agreement require that all Participating States comply with these national standards. Treasury has identified compliance and oversight as important areas for the establishment of national standards.

These national compliance standards are a complement to, but not a substitute for, the requirements set forth in the Act, the Allocation Agreement, and the SSBCI Policy Guidelines. Notwithstanding the recommended best practices that this document sets forth, each Participating State retains responsibility for ensuring compliance with the Act, the Allocation Agreement (including all related documents incorporated by reference in Section 8.2) , and the SSBCI Policy Guidelines.

The first section of this document, Recommended Framework for Identifying, Monitoring, and Managing Compliance and Oversight Risks, provides Treasury’s recommended approach for designing and implementing a comprehensive compliance and oversight system. This recommended framework is built upon the following six key elements:

• Centralizing the coordination of compliance and oversight;

• Identifying key compliance and oversight risks;

• Assessing the likelihood and severity of these risks;

• Developing a risk monitoring and mitigation plan;

• Conducting periodic testing; and

• Taking corrective actions as needed.

The second section, Treasury Guidance on Key Compliance and Oversight Risks, provides further guidance on the mitigation of 11 specific risks. Treasury identified these 11 risks based on its assessment of the relative impact and likelihood of each risk, as well as a review of technical assistance requests from Participating States to determine which compliance and oversight responsibilities required further explication. For each of these risks, Treasury provides:

• A cross reference to the related duty imposed on Participating States by the Act, the Allocation Agreement, or SSBCI Policy Guidelines, as applicable;

• Treasury’s guidance related to any such duty, as applicable; and,

• Treasury’s suggested best practices for risk mitigation.

The Treasury Inspector General is authorized to review Participating States’ compliance with SSBCI program requirements and prohibitions in conjunction with the recommendations and best practices set forth in this document in order to identify any intentional or reckless misuse of funds.

Please note that the contents of these standards may be updated periodically to reflect newly available guidance or information. When and if these standards are updated, Treasury will publish a Notice of Availability in the Federal Register and notify the Participating States’ Authorized Official and Point of Contact via e-mail. Participating States may also visit the U.S. Department of Treasury’s SSBCI website (http://www.treasury.gov/ssbci) to review and download the latest version.

Recommended Framework for Identifying, Monitoring, and Managing Compliance and Oversight Risks

Centralize Coordination of Compliance and Oversight

Treasury recommends that each Participating State designate a single employee as the individual responsible for managing the day-to-day compliance activities for the Participating State’s Approved State Programs. This individual should be an employee whose responsibilities span all SSBCI related compliance activities and may be someone other than the Participating State’s Authorized Representative. This individual should coordinate all of the activities listed in this section. Depending on the size and scope of a Participating State’s Approved State Programs, this function may be performed by an individual on a less than full time basis.

Identify Key Compliance and Oversight Risks

Treasury has identified the following 11 high-potential risks for most Approved State Programs:

1. Inadequate Borrower and Investee Certifications;

2. Inadequate Lender/Investor² Certifications;

3. Inadequate Lender/Investor Adherence to Requirements;

4. Inadequate Oversight of Administering entities and Other Entities Included in Annex 1 of the Allocation Agreement (if applicable);

5. Failure to Submit Timely and Accurate SSBCI Quarterly and Annual Reports;

6. Inadequate Control and Retention of Records;

7. Inadequate Documentation of Subsequent Private Financing;

8. Improper Usage of, and Accounting for, Allocated Funds;

9. Fraud, Waste, and Abuse;

10. Conflicts of Interest;

11. [For municipalities only] Lack of Adequate Justification for Loans or Investments Made Outside of Municipal Boundaries.

Treasury recommends that Participating States actively monitor, mitigate, and manage these specific risks as well as any other identified risks that are unique to the design of a particular Approved State Program.

Assess the Likelihood and Severity of Key Compliance and Oversight Risks

Each Participating State should assess the likelihood and impact of each key compliance and oversight risk (see above) as well as for each program- or state-specific risks identified. Often, this may result in a three-tiered rating of ”high”, ”medium”, or “low.” To determine the risk rating, the Participating State should make an informed judgment about the likelihood and impact of non-compliance by considering whether vulnerabilities exist that may result in instances of non-compliance with SSBCI requirements. Participating States should also consider how risks might arise throughout the chain of authorizations, certifications, and approvals among the Participating State’s implementing entity (including employees and board members, if applicable), any administering entities, lenders or investors, and small business borrowers/investees.

An important part of this recommended risk assessment consists of reviewing all available internal or external audits of the implementing entity, Approved State Program(s), or administering entities identified in Annex 1 of the Allocation Agreement. If the Approved State Program’s audit, or the audit of the entity administering a particular Approved State Program, contains findings, material weaknesses, or significant deficiencies, the risk rating should be adjusted accordingly, particularly if the finding, material weakness, or significant deficiency pertains to an identified risk category. Participating States should also promptly develop, monitor, and implement a corrective action plan. Treasury encourages Participating States to provide Treasury with copy of any audit containing findings, material weaknesses, or significant deficiencies, as well as a copy of the management response.

Develop a Risk Monitoring and Mitigation Plan

Treasury recommends that each Participating State document its plan and detailed procedures for monitoring, mitigating, and managing compliance and oversight risks. One effective way for Participating States to organize this document would be in a matrix; however, other approaches that trace the relationship between each risk and the associated control objectives, control activities, and testing protocols may be equally effective. The matrix (or an equivalent document) should include the 11 risks that Treasury identified as generally applicable to all Approved State Programs, as well as any additional risks that the Participating State believes are necessary to address state- or program-specific risks, and a rating for each risk, as discussed above.

For each risk, Treasury recommends that the Participating State document a specific plan for monitoring, mitigating, and managing risk by:

1. Defining control objectives to mitigate each risk. A control objective is the specific target used to determine whether a control is operating effectively. It can also be thought of as a management goal focused on mitigating a specific compliance and oversight risk. For example, a control objective regarding reporting might be as follows: “SSBCI quarterly or annual reports are submitted on time and are complete, accurate, and consistent with the state’s general ledger entries and documentation.” Many of these control objectives can be easily derived from the 11 risks that Treasury has identified as high-potential for most Approved State Programs; however, Participating States should consider whether additional program or state-specific risks merit additional control objectives.

2. Specifying control activities for each control objective. One definition of control activities, which is provided by the Government Accountability Office (GAO)³ , is as follows: “Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives, such as the process of adhering to requirements. They help ensure that actions are taken to address risks.”⁴ Control activities are the policies and procedures that organizations follow to ensure that they achieve the control objectives.

3. Specifying the planned test methodology, sample size, and testing frequency for each control activity. Treasury recommends that controls testing be conducted at least annually. However, for risks with a risk rating of ”medium” or ”high,“ Participating States should consider expanding the sample size and/or conducting more frequent controls testing to mitigate compliance risk and to ensure a robust control environment.

Treasury recommends that Participating States should conduct testing for each control activity using a statistically valid sample⁵. Statistical samples should be designed based on widely accepted statistical sampling principles. The required sample size should be based on factors including the size of the population, the acceptable margin of error, and the confidence level desired. Statistical sample calculators are available on the Internet, and Participating States may find these useful when determining the appropriate sample size.

Participating States should document the statistical sampling technique, methodology, and rationale for the sample size and sample frequency of each test conducted.

One effective way to organize this information, as stated above, is in a compliance and internal controls matrix. Such a matrix would typically include a row for each risk category, followed by columns for the risk rating; control objectives; control activities; planned test methodology, sample size, and testing frequency. Test results and the resolution of any corrective actions, if required, could subsequently be added to this matrix.

Conduct Periodic Testing

Treasury recommends that Participating States test a statistically significant sample of the Participating State’s records on a periodic basis to determine whether the Participating State is adhering to the control activities listed in the Participating State’s compliance and internal controls matrix (or equivalent document). Treasury does not require that Participating States conduct any particular audit as part of its compliance system. However, Treasury does recommend that controls testing be conducted at least annually. Participating States should make a risk-based determination as to whether more frequent controls testing is warranted. In order to ensure objectivity, controls testing should be conducted by an individual that (1) is not responsible for performing any of the control activities established by the Participating State; and, (2) does not report to any individual responsible for performing or overseeing any of the Participating State’s risk mitigation control activities. Typically, the employee designated as responsible for overseeing compliance should also review test results.

If a Participating State becomes aware of the fact that an ineligible loan or investment has been enrolled in an Approved State Program, the Participating State should contact the SSBCI Compliance Manager to determine the corrective actions, including whether to amend any prior submitted SSBCI quarterly or annual reports.

If an employee of a Participating State, administering entity, or implementing agency identifies any instances of fraud, waste, or abuse, he or she should contact the Treasury Office of Inspector General immediately. See http://www.treasury.gov/services/report-fwa/Pages/ReportFWA.aspx for more information about how to contact the Treasury Office of Inspector General.

Take Corrective Actions as Needed

If test results indicate isolated and non-repeating instances of non-compliance, the Participating State should take all necessary steps to bring these applicable records into compliance. However, if test results indicate systematic non-compliance with a particular control activity, rather than an isolated instance of non-compliance, the Participating State should assess the results to determine the cause and take corrective actions. Corrective actions may include, but are not limited to, enhanced staff training, enhanced training or technical assistance for lenders/investors or administering entities, the development of checklists, the development or enhancement of IT systems to identify non-compliant records, or updated policies and procedures.

Participating States should document test results and assess whether test results suggest the need for increased frequency or scope of compliance and internal controls testing.

Treasury Guidance on Key Compliance and Oversight Risks

This section is organized around the risks that Treasury identified as high-potential for most Approved State Programs.⁶ For each of these risks, Treasury references the related applicable sections of the Allocation Agreement and/or SSBCI Policy Guidelines, any applicable FAQs or other official interpretation of these requirements, and recommended best practices to mitigate these risks.

Risk: Inadequate Small Business Borrower/Investee Certifications

Use of Proceeds Certifications (Small Business Borrower/ Investee)

Article IV of the Allocation Agreement and Sections VI, VII, and XII of the SSBCI Policy Guidelines outline the restrictions on the acceptable uses of loan and investment proceeds. Specifically, these provisions require that small business borrowers (or investees) must make a certification to the lender or investor regarding the use of loan or investment proceeds for each SSBCI-supported transaction.

Participating States (or, as applicable, administering entities, lenders, or investors) may design their own certification forms but at a minimum the small business borrower or investee must certify, to the standards established in the SSBCI Policy Guidelines, that:

• Proceeds will be used for an eligible business purpose;

• Proceeds will not be used to pay for any purposes prohibited by the SSBCI Policy Guidelines;

• The small business borrower (or investee) is not an executive officer, director, or principal shareholder (or a member of the immediate family or a related interest of such individual) of the lender (or investor); and,

• The small business borrower (or investee) is not engaged in any of the activities or sources of income prohibited in the SSBCI Policy Guidelines.

As noted above, standards and examples of such terms as “business purpose”, “principal”, “lender”, and prohibited loan purposes are included in the SSBCI Policy Guidelines.

Treasury has provided a sample use of proceeds certification form in Appendix A of this document. Participating States may combine this use of proceeds certification with the small business borrower’s or investee’s sex offender certification into a single form.

While Treasury does not require Participating States (or administering entities, lenders, or investors, if so designated) to independently verify the representations made by the authorized representative of the small business borrower or investee with respect to the use of proceeds, Treasury does expect Participating States, as part of their compliance monitoring procedures, to establish a process to determine whether these required certifications have been adequately documented.

Treasury believes that Participating States could meet this expectation by either:

• Obtaining, reviewing, and maintaining a copy of each small business borrower’s (or investee’s) certification⁷ itself; or,

• Executing an agreement that requires the administering entity, or each lender or investor (as applicable), to obtain, review, and maintain copies of the small business borrower’s (or investee’s) use of proceeds certifications. Participating States should exercise appropriate oversight of the administering entity, lenders, or investors, tasked with this responsibility. One means of exercising this oversight would be to conduct an annual audit of each lender or investor’s transaction files to verify that the use of proceeds certifications are on file and properly executed.

Sex Offender Certifications (Small Business Borrower/ Investee)

Section 3011(c)(2) of the Act requires, “any private entity that receives a loan, a loan guarantee, or other financial assistance using [SSBCI] funds,” must certify that their principals have not been convicted of a sex offense against a minor (as such terms are defined in section 111 of the Sex Offender Registration and Notification Act (42 U.S.C. 16911)). The SSBCI Policy Guidelines and Section 4.9(c) of the Allocation Agreement implement this requirement by specifying that the Participating State has the responsibility to obtain a certification regarding sex-offender status covering all principals of a small business receiving an SSBCI-supported loan or investment. Section 1.1 of the Allocation Agreement defines the following covered individuals under the definition of “principal” for the sole purpose of collecting the sex offender certification:

“’Principal‘ shall mean, for purposes of Section 4.9, if a sole proprietorship, the proprietor; if a partnership, each managing partner and each partner who is a natural person and holds a 20% or more ownership interest in the partnership; and if a corporation, limited liability company, association or a development company, each director, each of the five most highly compensated executives or officers of the entity, and each natural person who is a direct or indirect holder of 20% or more of the ownership stock or stock equivalent of the entity.”

It is the Participating State’s responsibility to obtain the certification, either electronically or in paper copy, and verify that it is complete and duly executed prior to transferring funds. Treasury recommends that this certification be collected prior to the loan or investment closing so that there is no delay in the transfer of funds to the borrower post-closing.

Treasury does not require Participating States (or administering entities, if so designated) to independently verify the certified sex offender status of borrowers or investees. For record retention purposes, Participating States may elect to have the certifications stored with the lender’s or investor’s transaction files. However, Treasury recommends that Participating States retain the sex offender certifications in order to mitigate risks associated with record retention requirements.

If the Participating State delegates any of these responsibilities to an administering entity, the Participating State must exercise oversight to verify compliance. One means of exercising this oversight would be to conduct an annual audit of the certifications to verify that the documents are in order and are being maintained pursuant to the records retention requirements discussed later in this document.

Treasury has provided a sample sex offender certification form in Appendix B of this document. As noted above, Participating States may combine the sex offender certification along with the borrower’s (or investee’s) use of proceeds certifications on a single form. However, Participating States must obtain a sex offender certification that covers each principal whereas the use of proceeds certification is only required from a single authorized representative of the small business. This may make administration of a combined certification form impractical in some cases.

Risk: Inadequate Lender/Investor⁸ Certifications

Use of Proceeds Certifications (Lender/ Investor)

As noted above, Article IV of the Allocation Agreement and Sections VI, VII, and XII of the SSBCI Policy Guidelines outline the restrictions on the acceptable uses of loan and investment proceeds. In addition to the use of proceeds certification made by the small business borrower (or investee), as described above, the lender (or investor, or in the case of a state-run direct loan⁹ or venture capital program, the Participating State itself) must also certify to the Participating State that:

• The loan or investment has not been made in order to place under the protection of the Approved State Program prior debt that is not covered under the Approved State Program and that is or was owed by the borrower to the lender or to an affiliate of the lender; and,

• The loan or investment is not a refinancing of a loan previously made to that borrower by the lender or an affiliate of the lender; and,

• The lender is not attempting to enroll the unguaranteed portions of SBA-guaranteed loans (applicable to loan programs only).

It is the Participating State’s responsibility to obtain this use of proceeds certification, either electronically or in paper copy, and to verify that it is complete and duly executed prior to transferring funds. Treasury has provided a sample certification in Appendix C of this document.

Treasury does not require Participating States (or administering entities, if so designated) to independently verify the representations made by a lender or investor regarding the use of proceeds. However, Treasury does expect that Participating States, as part of their compliance monitoring procedures, will establish a process to determine whether these required certifications have been adequately documented. For record retention purposes, Participating States may elect to store the certifications with the lender’s or investor’s transaction files. However, Treasury recommends that Participating States retain the use of proceeds certifications in order to mitigate risks associated with record retention requirements.

If the Participating State delegates the responsibility to obtain this certification to an administering entity, the Participating State must exercise appropriate oversight of the administering entity. One means of exercising this oversight would be to conduct an annual audit of each lender or investor’s transaction files to verify that the use of proceeds certifications are on file and signed by an authorized representative of the lender or investor.

It is not sufficient for a lender or investor to provide a one-time certification of compliance with these requirements as part of a lender or investor participation agreement; the lender or investor must certify the use of proceeds for each individual loan or investment.

Treasury also recommends that Participating States:

• Require the lender or investor to describe the loan or investment purpose on a transaction enrollment form (see Timely and Accurate SSBCI Quarterly and Annual Reports, below), and review this description for conformity with SSBCI requirements prior to enrolling the transaction in an Approved State Program.

• Include a clause in each lender (or investor) participation agreement prohibiting the lender or investor from enrolling a transaction that violates SSBCI’s restrictions on the use of proceeds.

Sex Offender Certifications (Lender/Investor)

Section 3011(c)(2) of the Act requires that, “any private entity that receives a loan, a loan guarantee, or other financial assistance using [SSBCI] funds,” must certify that their principals have not been convicted of a sex offense against a minor (as such terms are defined in section 111 of the Sex Offender Registration and Notification Act (42 U.S.C. 16911)).

The SSBCI Policy Guidelines and Section 4.9(c) of the Allocation Agreement implement this requirement by specifying that the Participating State has the responsibility to obtain a certification regarding sex-offender status, and that the term “private entity” includes all lenders or investors¹⁰ enrolling a loan or investment in an SSBCI Approved State Program. The definition of “private entity” also encompasses private or non-profit administering entities that make loans or investments directly to borrower/investees through an approved direct lending program, loan participation program, or state-run venture capital program. In addition, the design of most direct loan programs, as well as loan participation programs based on companion loans rather than purchased participations, is such that lenders making companion loans must also provide the required sex offender certifications. If a Participating State believes that this requirement may not apply to its direct loan or loan participation program due to specific program-design considerations, the Participating State should contact Treasury for further consultation.

Like with the small business borrower or investee sex offender certification, all principals of the lender or investor must certify sex offender status. Section 1.1 of the Allocation Agreement defines “principal”, for the sole purpose of collecting the sex offender certification:

“‘Principal’ shall mean, for purposes of Section 4.9, if a sole proprietorship, the proprietor; if a partnership, each managing partner and each partner who is a natural person and holds a 20% or more ownership interest in the partnership; and if a corporation, limited liability company, association or a development company, each director, each of the five most highly compensated executives or officers of the entity, and each natural person who is a direct or indirect holder of 20% or more of the ownership stock or stock equivalent of the entity.”

Participating States may meet their obligation to obtain these sex-offender status certifications in one of two ways. Participating States may either:

• Obtain newly executed sex offender certifications¹¹ from the covered principals of a lender or investor prior to enrolling each loan or investment in an SSBCI Approved State Program; or,

• Obtain a set of sex offender certifications prior to enrolling any loans or investments originated by that lender or investor in the Approved State Programs and execute a written agreement with the lender or investor (which may be part of a larger lender, or investor, participation agreement) that creates a positive requirement to notify the Participating State if and when an event occurs that renders the prior set of certifications obsolete. Such event could be a change in principals or a conviction of an existing principal for a sex offense against a minor. The Participating State may also consider adding a requirement to this written agreement for a periodic resubmission of the certifications, perhaps on an annual basis, even absent a material event.

Under either of the options above, it is the Participating State’s responsibility to obtain the certification, either electronically or in paper copy, in order to verify that it is complete and duly executed prior to transferring funds. Treasury does not require Participating States (or administering entities, if so designated) to independently verify the certified sex offender status of covered principals. Treasury has provided a sample sex offender certification form as Appendix B to this document.

If the Participating State delegates these responsibilities to an administering entity, the Participating State must exercise oversight to ensure compliance. One means of ensuring oversight would be to conduct an annual audit of the certifications to ensure that the documents are in order and are maintained pursuant to the records retention requirements discussed later in this document.

Risk: Inadequate Lender/Investor Adherence to Requirements

In addition to the required certification of sex offender status, Section 4.9 of the Allocation Agreement requires that, prior to providing any financial assistance using Allocated Funds to a lender or investor, the Participating State must obtain the following: (a) a binding agreement regarding Treasury’s right to access records related to SSBCI-supported loans and investments and (b) certification that the lender or investor is in compliance with the requirements of the Right to Financial Privacy Act (12 U.S.C. § 3401 et seq.), and 31 C.F.R. § 103.121, if applicable.

Treasury recommends that, prior to enrolling any loan originated by a private lender, and prior to enrolling any investment made by a venture capital investor, the Participating State (or administering entity) should execute a signed lender/investor participation agreement to clarify lender/investor responsibilities and reduce the likelihood of non-compliance. This agreement should:

• Specify lender/investor responsibilities regarding SSBCI’s restrictions on use of proceeds;

• Specify lender/investor responsibilities regarding sex offender certifications;

• Require that the lender/investor make all books and records related to the use of allocated funds available to Treasury and/or the Treasury Inspector General;

• Specify all eligibility requirements for loans/investments for each applicable Approved State Program; and

• Specify consequences for non-compliance with the terms of the agreement.

If a lender/investor is specifically identified in Annex 1 of the Allocation Agreement as an administering entity, then this agreement must also adhere to the requirements of Articles IV and VI of the Allocation Agreement, as described in the following section.

Recommended additional provisions may also include:

• Mandate the use of a transaction enrollment form; and

• Specify any required data reporting elements from the lender/investor to the Participating State (or its administering entity).

These best practices are designed to assist the Participating State in tracking the use of Allocated Funds and gathering data for the required SSBCI quarterly and annual reports.

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

Risk: Inadequate Oversight of Administering Entities and Other Entities Included in Annex 1 of the Allocation Agreement

Note: if none of the Approved State Programs are operated by contracting/administering entities, this risk category may not apply. Regardless of direct applicability, Treasury expects that Participating States will provide due diligence and oversight over all contract entities that may perform work ancillary to an Approved State Program.

Participating States that contract with one or more entities to administer specific aspects of Approved State Programs must execute and maintain a written agreement with each of these entities that requires compliance with the provisions of Articles IV and VI of the Allocation Agreement.

Prior to disbursing any funds to an administering entity, the Participating State must execute a written agreement applying the provisions of Articles IV and VI to the administering entity.¹² Treasury calls special attention the following requirements that must be incorporated into the agreement:

• The administering entity must make all books and records related to the use of allocated funds available to Treasury and/or the Treasury Inspector General;

• The administering entity is prohibited from enrolling the unguaranteed portion of any SBA-guaranteed loan (note: this provision does not apply to venture capital programs);

• The administering entity must comply with all administrative expense requirements, including OMB Circular A-87, and maintain substantiating documentation for all expenses; and

• The administering entity must comply with all data collection and reporting responsibilities. The agreement should specify the respective roles of the administering entity and the Participating State in meeting all data collection and reporting responsibilities, and include the Participating State’s transaction enrollment form, if applicable.

Recommended best practices include:

• Inserting additional contract provisions that:

• Specify the administering entity’s responsibilities regarding use of proceeds and sex offender certifications;

• Specify all eligibility requirements for loans/investments for each applicable Approved State Program;

• Prohibit, or require disclosure of, an administering entity underwriting or approving a loan to, or an investment in, any firm in which the administering entity or any of its principals or affiliates has a direct or indirect financial interest; and

• Specify consequences for non-compliance with the terms and conditions of the contract.

• Reviewing third-party audits of the administering entity for findings, material weaknesses, or significant deficiencies, and require the administering entity to take corrective actions.

• Performing site visits, requiring periodic status update reports, and/or conducting regular conference calls with the administering entity to monitor progress and provide early warning of any implementation challenges.

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

Risk: Failure to Submit Timely and Accurate SSBCI Quarterly and Annual Reports

Sections 4.7, 4.8, and Annexes 4, 5, and 7 of the Allocation Agreement set forth SSBCI’s reporting requirements. Failure to submit complete and timely reports is an event of default, as described in Section 6.1 of the Allocation Agreement.

In order to improve the accuracy of the underlying data reported in these reports, Treasury strongly recommends that prior to enrolling a loan or investment in an Approved State Program, the Participating State (or administering entity) collects a transaction enrollment form from the lender or investor (or directly from the small business borrower/investee if the Participating State or its administering entity makes direct loans or investments). The Participating State should also verify that all data fields required to record the transaction in the SSBCI annual report template—including small business borrower-provided estimates of job creation and retention—have been provided.

Treasury recommends receiving this enrollment form prior to disbursing funds in order to ensure that each transaction meets the eligibility criteria for enrollment in an Approved State Program. Section II of the SSBCI Policy Guidelines establishes eligibility criteria for small businesses to receive loans or investments.

Treasury recommends that Participating States undertake the following control activities to mitigate the potential for inaccurate data reporting:

• Review the accuracy of transaction enrollment forms by conducting a periodic audit of an appropriately sized sample and confirming that the data on the form matches the data on the underlying loan or investment documents;

• Perform a quality control check in which an employee not responsible for the Participating State’s reporting function compares individual transactions listed on the annual report to the transaction enrollment forms and/or underlying loan or investment documents; and,

• Reconcile each calendar year’s four SSBCI quarterly reports to the SSBCI annual report and Federal Financial Report (SF-425).

Participating States should consider adding to this list any additional activities that may be useful to provide mitigating controls associated with this risk. When developing control objectives and control activities, and when designing the testing methodology for these control activities, Participating States should pay particular attention to risks introduced by administering entities, lenders/investors, and small business borrowers/investees in the program.

Risk: Inadequate Control and Retention of Records

Section 4.13 of the Allocation Agreement establishes that Participating States shall retain all financial records, supporting documents, statistical records, and all other records pertinent to the Allocation for a period of three years from the date of submission of the final quarterly report, except as otherwise provided in the grants management common rule at §__.42. Section 42 of the grants management common rule states that if any litigation, claim, negotiation, audit, or other action involving the records has been started before the expiration of the retention period, the records must be retained until the completion of the action and resolution of all issues or the end of the retention period, whichever is later.

Participating States must therefore retain all financial records and supporting documents at least through January 30, 2020. Financial records and supporting documents include, but are not limited to: all loan and investment agreements; loan or investment commitment letters; all sex offender and use of proceeds certifications retained by the Participating State; any transaction enrollment forms; all general ledger entries pertaining to Allocated Funds; all statements for accounts containing Allocated Funds, including bank statements if applicable; any contracts or memorandum of agreement (MOA) with administering entities; any records of all transfers of funds to administering entities; all invoices and receipts for administrative expenses; and, documentation of private leverage and subsequent private financing. Furthermore, if lenders and investors, or an administering entity, are required to retain any records rather than submitting these records to the Participating State or administering entity—the Participating State must have a written agreement in place requiring the maintenance of these records until at least January 30, 2020, and the Participating State must exercise oversight to verify compliance. One means of exercising this oversight would be to conduct an annual audit of a random sample of each lender’s or investor’s (or the administering entity’s) financial records.

Participating States should consider adding any additional activities that may be useful to provide additional mitigating controls associated with records retention.

Risk: Inadequate Documentation of Subsequent Private Financing

Section 4.8 of the Allocation Agreement requires, under circumstances described in Annex 7 of the Allocation Agreement, Participating States to report the amount of additional private financing that occurs after the closing of the original SSBCI-supported transaction. This term of the Allocation Agreement means that the Participating State must maintain documentation of the amount of subsequent private financing, as well as the rationale for determining that the subsequent private financing is the “cause and result” of the original SSBCI-supported transaction, when required by Annex 7.

If the enrollment of loans or investments is handled by an administering entity, the Participating State may delegate the responsibility for obtaining and retaining this documentation to the administering entity pursuant to a written contract, provided that the Participating State exercises oversight of the administering entity to ensure compliance with this requirement. One means of exercising this oversight would be to conduct an annual audit of a random sample of loans or investments for which subsequent private financing has been recorded.

Treasury recommends that Participating States undertake the following additional control activities based on the guidance provided in Annex 7 of the Allocation Agreement:

• Verify that no subsequent private financing for loans enrolled in a loan guarantee or collateral support program is recorded, unless the Participating State has received documented permission from Treasury;

• Verify that subsequent private financing is recorded only when the initial loan/investment is a form of subordinate, mezzanine, or equity financing.

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

Risk: Improper Usage of, and Accounting for, Allocated Funds

Section 4.2 of the Allocation Agreement establishes that the Participating State shall only “use” the Allocated Funds for the purposes and activities specified in the Allocation Agreement and in accordance with the cost principles set forth in OMB Circular A-87 (Cost Principles for State, Local, and Indian Tribal Governments) and codified in 2 C.F.R. Part 225. These cost principles stipulate that administrative costs must be allowable, allocable, reasonable, and documented, and that all indirect costs be in accordance with the indirect cost rate proposal approved by the Participating State’s cognizant agency¹³.

It is also important to note that the Allocation Agreement includes Annex 1, which specifies the administering entities and the Approved State Programs authorized by Treasury, and Annex 3, which establishes the maximum amount available to the Participating State to pay for direct and indirect administrative costs pertaining to the Approved State Programs. Additionally, Section 8.2 of the Allocation Agreement also incorporates a number of other documents and representations, including the Participating State’s Application, by reference.¹⁴

For the purposes of Section 4.2 of the Allocation Agreement, the phrase “use” means any expenditure, obligation or transfer of Allocated Funds for the purpose of carrying out the Approved State Programs, as described in Annex 1 of the Participating State’s Allocation Agreement, as well as the Participating State’s Application.

As such, Allocated Funds may not be used, under any circumstances, to provide services or make loans, grants, or investments under any program other than those specifically listed in Annex 1 of the Allocation Agreement, or to pay for direct or indirect administrative expenses related to any non-SSBCI program. Treasury cautions Participating States to pay particular attention to the requirement in OMB Circular A-87 that costs be allocable. If, for example, staff assigned to the Approved State Program also work on other non-SSBCI programs, the Participating State must ensure that staff accurately record the number of hours spent on the Approved State Program and only use Allocated Funds to pay salaries and benefits in proportion to the number of hours worked. For example, if an employee spends 45 percent of her time on an SSBCI Approved State Program, the Participating may only charge 45 percent of her salary and benefits to Allocated Funds.

Furthermore, Section 4.6 of the Allocation Agreement requires Participating States to comply with the standards of financial management systems outlined in the grants management rule at §__.20, with the exception of the cash management requirements. (See Appendix D for the excerpted Section 20 of the grants management common rule.) Treasury draws Participating States’ attention to the accounting requirements set forth in §__.20(b)(2) of the grants management common rule. According to this term, Participating States must keep detailed records of its receipt of Allocated Funds, and be able to trace the use of these funds to specific expenditures, obligations, or transfers for the purposes of carrying out an Approved State Program.

Allocated Funds that have been disbursed to the Participating State, but not yet expended, obligated, or transferred for allowable program purposes, should be maintained as cash or a cash equivalent¹⁵. The movement of Allocated Funds in and out of the implementing entity’s bank account must be tracked separately from the remainder of the funds in this account. Participating States may not expend Allocated Funds for any non-allowable purpose and then “reimburse” the Allocated Funds at a later date.

Participating States should also consider it a best practice to develop the following controls:

• Segregate Allocated Funds in a separate bank account;

• Require dual control for the approval of all expenditures, obligations, or transfers of Allocated Funds. For example, one individual may prepare and track these expenditures, obligations or transfers, and a second individual may approve them. These employees should not be in each other’s supervisory chain of command;

• Conduct a monthly reconciliation of all invoices, receipts, loan and investment agreements, and other documentation of SSBCI expenditures, obligations, and transfers; general ledger entries; and bank account statements. Verify that all deposits and withdrawals of Allocated Funds match general ledger entries, and that these general ledger entries are supported by the substantiating documentation. To ensure segregation of duties, this reconciliation should be performed by an employee that is neither the individual responsible for cash transactions, nor in the supervisory chain of the individual responsible for cash transactions;

• Require an employee other than the employee recording and tracking administrative expenses to verify that each direct expense is accompanied by an invoice or receipt, that the amount shown on the invoice or receipt matches the expense recorded, and that the service or item purchased is directly related to an Approved State Program;

• Require all employees to maintain time records showing the number of hours spent on SSBCI Approved State Programs each pay period; and

• Require that purchase requests and contracts be approved only after staff verified that the purchase or contract will not cause total administrative expenses to exceed the maximum amounts set forth in Annex 3 of the Allocation Agreement, unless administrative expenses will be paid for using non-Allocated Funds.

Risk: Prevention of Fraud, Waste, and Abuse

Preventing fraud, waste, and abuse is an important part of preventing the misuse of Allocated Funds. Participating State should consider it a best practice to develop the following controls:

• Require all loans or investments to be approved by a board or committee, with meeting minutes documenting the basis for the underwriting/enrollment decision;

• Require all contracts to be awarded pursuant to a formal Request for Proposals, with clearly established evaluation criteria and a transparent bidding and award process;

• Maintain strict controls over access to bank accounts;

• Maintain strict controls over access to documents, records, and assets;

• Maintain strict information technology security protocols to prevent unauthorized access to IT systems and unauthorized manipulation of data;

• Require all staff to complete anti-fraud and ethics training;

• Require staff overseeing administering entities to verify that work was performed before paying an administering entity’s invoice;

• Maintain segregation of duties (e.g., employees who perform cash functions should not reconcile bank account statements);

• Reconcile invoices to purchase orders and contracts; and

• In the event of cash transactions, compare cash receipt transactions to a cash receipt log and bank deposit records to minimize the possibility of theft, fraud or abuse

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

Risk: Conflicts of Interest

Preventing conflicts of interest in underwriting, enrollment, contracting, and lender/investor participation decisions is important to prevent the misuse of allocated funds as well as any appearance of impropriety. The Allocation Agreement and SSBCI Policy Guidelines address certain conflict of interest issues. For example, Section 4.4 of the Allocation Agreement specifically prohibits using Allocated Funds for lobbying, or for making a loan, investment, or contract to a member of Congress or a resident U.S. Commissioner. In addition, Section VI and VII of the SSBCI Policy Guidelines prohibits funds from being used to make loans to borrowers who are executive officers, directors, or principal shareholders of the lender or investor, or a family member of related interest of an executive officer, director, or principal shareholder of the lender of investor. However, Treasury believes that additional conflicts of interest could arise, and that Participating States should carefully assess whether other conflicts of interest should be identified, monitored, and mitigated.

Participating State should also consider it a best practice to develop the following controls:

• Require all individuals involved in the underwriting or approval process to disclose any potential or actual conflicts of interest, in accordance with the Participating State’s written conflict of interest policy, and to recuse him or herself if a conflict of interest occurs;

• Require all individuals involved in the contracting process to disclose any potential or actual conflicts of interest, in accordance with the Participating State’s written conflict of interest policy, and to recuse him or herself if a conflict of interest occurs; and

• Require all individuals involved in evaluating and executing lender/investor participation agreements to disclose any potential or actual conflicts of interest, in accordance with the Participating State’s written conflict of interest policy, and to recuse him or herself if a conflict of interest occurs.

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

Risk: Lack of Adequate Justification for Loans or Investments Made outside of Municipal Boundaries (Applies to Municipalities Only)

Section 4.4(f) of the Allocation Agreement for municipalities includes the following term:

“The Participating Municipality shall not use Allocated Funds outside the geographic borders of the Participating Municipality unless the Authorized Municipal Official or chief executive of the Participating Municipality warrants, in writing, that the loan or investment will result in significant economic benefit to the Participating Municipality.”

The Municipality FAQs offer the following additional guidance:

“When evaluating criteria to determine if a loan or investment made outside of its geographic borders yields significant economic benefit, Participating Municipalities should consider the impacts that the transaction will have on a) jobs created or maintained within the Participating municipality; b) increasing the amount of sales, income, or other tax revenue to the Participating Municipality; or c) the benefit of the goods or services provided by the small business to the Participating Municipality or businesses within the Participating Municipality. “

As a result of this term of the Allocation Agreement and the guidance in the FAQ , prior to enrolling any loan to, or investment in, a small business located outside the municipal boundaries described in the Application, the mayor or chief executive of the Participating Municipality must warrant, in writing, that the loan or investment will yield a significant economic benefit to the Participating Municipality. If more than one municipality is participating in a consortium of municipalities receiving SSBCI funding, the mayor or chief executive of the municipality that anticipates an economically significant benefit should sign the warranty. Should more than one Participating Municipality derive benefit from a single loan or investment in a small business that is outside the boundaries of any Participating Municipality, then each mayor or chief executive of the Participating Municipalities expected to derive a significant economic benefit from the loan or investment may sign the warranty. The warranties should be maintained with the loan or investment files.

If the enrollment of loans and investments is handled by an administering entity, the Participating Municipality (or consortium of Participating Municipalities) may, alternatively, delegate the responsibility for retaining the warranties signed by the mayor or chief executive of the Participating Municipality to the administering entity pursuant to a written contract, provided that the Participating Municipality (or consortium of Participating Municipalities) exercises oversight of the administering entity to ensure this requirement is complied with. One means of exercising this oversight would be to conduct an annual audit of a random sample of loans or investments made outside the specified municipal boundaries.

Participating States should consider adding to this list any additional activities that may be useful to provide additional mitigating controls associated with this risk.

S

Treasury has created this sample self-certification that a participating state, territory or municipality may use in order to obtain certification from small business borrowers or investees. This certification is not intended to replace or supersede any internal controls the participating state, territory, or municipality has in place. Rather, this certifications is provided for illustrative purposes and is available for use by the participating state, territory, or municipality according to their discretion. These sample certifications are also attached as Annexes to the SSBCI Frequently Asked Questions Document available at www.treasury.gov/ssbci.

ample Small Business Borrower/Investee Certification for Use of Proceeds

These assurances reference Section 3005(e)(7) and Section 3011(c)(2) of the Small Business Jobs Act of 2010.

Legal name of borrower or investee: ________________________________________________________

The borrower or investee hereby certifies the following to the lender or investor:

1. The loan or investment proceeds will be used for a “business purpose.” Business purpose includes, but is limited to, start up costs, working capital, business procurement, franchise fees, equipment, inventory, as well as the purchase, construction renovation or tenant improvements of an eligible place of business that is not for passive real estate investment purposes. The definition of business purpose excludes: activities that relate to acquiring or holding passive investments, such as commercial real estate ownership and the purchase of securities; and lobbying activities, as defined in Section 3(7) of the Lobbying Disclosure Act of 1995, P.L. 104-65, as amended.
   
   

2. The loan or investment proceeds will not be used to:

   1. repay a delinquent federal or state income taxes unless the Borrower has a payment plan in place with the relevant taxing authority; or

   2. repay taxes held in trust or escrow, e.g. payroll or sales taxes; or

   3. reimburse funds owed to any owner, including any equity injection or injection of capital for the business’ continuance; or

   4. to purchase any portion of the ownership interest of any owner of the business.
      
      

3. The borrower or investee is not:

   1. an executive officer, director, or principal shareholder of the lender; or

   2. a member of the immediate family of an executive officer, director, or principal shareholder of the lenders; or

   3. a related interest of an such executive officer, director, principal shareholder, or member of the immediate family.
      
      

For the purposes of these three restrictions, the terms “executive officer”, “director”, “principal shareholder”, “immediate family”, and “related interest” refer to the same relationship to a lender as the relationship described in part 215 of title 12 of the Code of Federal Regulations, or any successor to such part.

4. The borrower or investee is not:

   1. a business engaged in speculative activities that develop profits from fluctuations in price rather than through normal course of trade, such as wildcatting for oil and dealing in commodities futures, unless those activities are incidental to the regular activities of the business and part of a legitimate risk management strategy to guard against price fluctuations related to the regular activities of the business; or

   2. a business that earns more than half of its annual net revenue from lending activities; unless the business is a non-bank or non-bank holding company Community Development Financial Institutions; or

   3. a business engaged in pyramid sales, where a participant's primary incentive is based on the sales made by an ever-increasing number of participants; or

   4. a business engaged in activities that are prohibited by federal law or applicable law in the jurisdiction where the business is located or conducted. (Included in these activities is the production, servicing, or distribution of otherwise legal products that are to be used in connection with an illegal activity, such as selling drug paraphernalia or operating a motel that knowingly permits illegal prostitution); or

   5. a business engaged in gambling enterprises, unless the business earns less than 33% of its annual net revenue from lottery sales.
      
      

Legal Name:

By:

Authorized Signatory

Name:

Title:

D ate:

E

Treasury has created this sample self-certification that a participating state, territory or municipality may use in order to obtain certification from lenders, investors, and small business borrowers or investees. This certification is not intended to replace or supersede any internal controls the participating state, territory, or municipality has in place. Rather, this certifications is provided for illustrative purposes and is available for use by the participating state, territory, or municipality according to their discretion. These sample certifications are also attached as Annexes to the SSBCI Frequently Asked Questions Document available at www.treasury.gov/ssbci.

xample Sex Offender Certification

(May be Used for Both Borrowers/Investees and Lenders/Investors)

This certification is required by Section 3011(c)(2) of the Small Business Jobs Act of 2010 from any private entity that receives a loan, a loan guarantee, or other financial assistance using funds received by a participating State under the State Small Business Credit Initiative.

Legal name of entity:

___________________________________________________________________

A s required by Section 3011(c)(2) of the Small Business Jobs Act of 2010, the private entity hereby certifies to the participating State that the Principals of the private entity have not been convicted of a sex offense against a minor (as such terms are defined in section 111 of the Sex Offender Registration and Notification Act (42 U.S.C. 16911)). For the purposes of this Certification, Principal means the following: if a sole proprietorship, the proprietor; if a partnership, each managing partner and each partner who is a natural person and holds a 20% or more ownership interest in the partnership; and if a corporation, limited liability company, association or a development company, each director, each of the five most highly compensated executives or officers of the entity, and each natural person who is a direct or indirect holder of 20% or more of the ownership stock or stock equivalent of the entity.

Legal Name:

By:

Authorized Signatory

Name:

Title:

Date:

Example Lender/Investor Certification for Use of Proceeds

T

Treasury has created this sample self-certification that a participating state, territory or municipality may use in order to obtain certification from lenders or investors. This certification is not intended to replace or supersede any internal controls the participating state, territory, or municipality has in place. Rather, this certifications is provided for illustrative purposes and is available for use by the participating state, territory, or municipality according to their discretion. These sample certifications are also attached as Annexes to the SSBCI Frequently Asked Questions Document available at www.treasury.gov/ssbci.

his Assurance is referenced by Section 3005(e)(7) of the Small Business Jobs Act of 2010.

Legal name of lender or investor:

___________________________________________________________________

The Lender/Investor hereby certifies to the Participating State the following:

1. The loan or investment has not been made in order to place under the protection of the approved state program prior debt that is not covered under the approved state program and that is or was owed by the borrower to the lender or to an affiliate of the lender.
   
   

2. T he loan or investment is not a refinancing of a loan or investment previously made to that borrower by the lender or an affiliate of the lender.
   
   

3. The lender is not attempting to enroll the unguaranteed portions of SBA-guaranteed loans.
   
   

Legal Name:

By:

Authorized Signatory

Name:

Title:

Date:

§__.20   Standards for financial management systems.

(a) A State must expand and account for grant funds in accordance with State laws and procedures for expending and accounting for its own funds. Fiscal control and accounting procedures of the State, as well as its subgrantees and cost-type administering entities, must be sufficient to—

(1) Permit preparation of reports required by this part and the statutes authorizing the grant, and

(2) Permit the tracing of funds to a level of expenditures adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes.

(b) The financial management systems of other grantees and subgrantees must meet the following standards:

(1) Financial reporting. Accurate, current, and complete disclosure of the financial results of financially assisted activities must be made in accordance with the financial reporting requirements of the grant or subgrant.

(2) Accounting records. Grantees and subgrantees must maintain records which adequately identify the source and application of funds provided for financially-assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income.

(3) Internal control. Effective control and accountability must be maintained for all grant and subgrant cash, real and personal property, and other assets. Grantees and subgrantees must adequately safeguard all such property and must assure that it is used solely for authorized purposes.

(4) Budget control. Actual expenditures or outlays must be compared with budgeted amounts for each grant or subgrant. Financial information must be related to performance or productivity data, including the development of unit cost information whenever appropriate or specifically required in the grant or subgrant agreement. If unit cost data are required, estimates based on available documentation will be accepted whenever possible.

(5) Allowable cost. Applicable OMB cost principles, agency program regulations, and the terms of grant and subgrant agreements will be followed in determining the reasonableness, allowability, and allocability of costs.

(6) Source documentation. Accounting records must be supported by such source documentation as cancelled checks, paid bills, payrolls, time and attendance records, contract and subgrant award documents, etc.

(c) An awarding agency may review the adequacy of the financial management system of any applicant for financial assistance as part of a preaward review or at any time subsequent to award.

1 Capitalized terms used herein and not defined herein shall have the respective meanings ascribed to them in the Allocation Agreement.

2 For the purposes of this document, “investor” refers to any private venture capital, seed stage, mezzanine, or angel fund participating in an Approved State Program. This term does not refer to individual investors in a fund.

3 While this GAO document is directed at federal executive branch agencies, rather than Sates, Treasury has identified this as a relevant and concise definition for the term “control activities” that may be helpful to Participating States.

4 GAO/AIMD-00-21.3.1 (11/99)

5 For most control activities, the universe of records will be the number of SSBCI-supported loans or investments. However, for some risks, the universe of records may be other types of documents. For example, to test compliance with the mandatory control activity for the “Inadequate oversight of administering entities” risk, a Participating State could evaluate the written agreement with the applicable entities against minimum requirements. See the next section, Treasury Guidance on Key Compliance and Oversight Risks, for further details on mitigating this risk.

6 There are nine risks that Treasury believes are applicable to all Participating States. Two additional risks may not be applicable to all Participating States: (1) ”Inadequate Oversight of Administering Entities” only applies to those Participating States that have an entity other than the implementing entity listed in Section 1B of the Participating State’s application administering the program(s). Administering entities are listed in Annex 1 of the Participating State’s Allocation Agreement. (2)”Lack of Adequate Justification for Loans or Investments Made Outside of Municipal Boundaries” applies only to municipalities participating in SSBCI.

7 While certifications may be scanned PDFs, they must contain a signature.

8 As noted previously, for the purposes of this document, “investor” refers to any private venture capital, seed stage, mezzanine, or angel fund participating in an Approved State Program. This term does not refer to individual investors in a fund.

9 When a Participating State makes a direct loan or a companion loan under an approved direct loan or loan participation program, three use of proceeds forms must be executed: one by the borrower (see previous section), one by the Participating State (since the Participating State is a lender in this case), and one by the lender making the companion loan. Similarly, if the Participating State makes a direct venture capital investment in a small business, three use of proceeds forms must be executed: one by the investee, one by the Participating State, and one by the venture capital firm.

10 As noted above, for the purposes of this document, “investor” refers to any private venture capital, seed stage, mezzanine, or angel fund participating in an Approved State Program. This term does not refer to individual investors in a fund. However, each principal of the private fund must execute a sex offender certification.

11 While certifications may be scanned PDFs, they must contain a signature.

12 The Participating State should do so by using the same language that is included in Articles IV and VI of the Allocation Agreement, except for substituting the name of the administering entity for the name of the Participating State.

13 The cognizant agency for all Participating States and most municipalities is the Department of Health and Human Services.

14 Section 8.2 of the Allocation Agreement states that the “application including any attachments, exhibits, appendices and supplements thereto, any attachments, schedules, annexes, appendices, and supplements to the Allocation Agreement, and said Allocation notice letter are incorporated in and made a part of this Agreement.”

15 Cash equivalents are very low risk, highly liquid assets, such as money market holdings, short-term government bonds or Treasury bills, marketable securities and commercial paper. The maturity period must be no more than 3 months.