By: Joseph Imperato, Sr., Partner, 
XSolutions Consulting Services, LLC

Those who ignore history are doomed to repeat it. As we launch into a new year, we must be mindful of the lessons from the past.
Below are a few things that every business must do to keep safe:

1. Use multifactor authentication wherever possible.
2. Use strong, unique passwords for EVERY application and never reuse old ones.
3. Regularly purge data when no longer needed, especially files containing sensitive information.
4. Make sure you review configurations of applications containing data that you expose in the public cloud.
5. Keep up on the latest technology changes and how they affect your IT. Things change, better technology comes along, tried and true tech becomes obsolete or breached. Always make sure that the apps you’re using are still safe.
6. Frequently check financial statements (banks, credit cards, credit reports, etc.) for anomalies.
7. Control where your documents are. Make sure that all company-related documents are saved on a protected server and not on individual employee workstations.
8. Security and privacy are not “nice to haves” but are required in business today. The GDPR in Europe was the first wakeup call to far-reaching privacy legislation. Since then, other countries and individual states within the U.S. have enacted similar laws with stiff penalties for those who ignore them. Make sure you understand the regulations that you are subject to and comply (i.e. GDPR, California Consumer Privacy Act, New York’s SHIELD Act, etc.).
9. ALWAYS backup your data and save one (1) copy onsite for super-fast restores, and Two (2) copies offsite in geographically dispersed cloud data centers for archival purposes should your site become damaged or destroyed in a catastrophe.
10. Don’t go it alone. If you do not have an IT department, then hire a Managed Services Provider (MSP) to manage your company’s network. An MSP will give you access to expert support, and will monitor, maintain, and secure your network. Today’s cyber-landscape is dangerous and without good IT support, your business is only a click away from disaster.

Take action to protect your business and your customers. Breaches are serious, can cost thousands of dollars in fines and lost revenue, and do irreputable damage to a company’s reputation. Make security your mantra. Good luck.

By: Stephanie O'Rourk, CPA, Partner, Tax and Advisory &Jeff Bobrosky, CPA, Partner, Assurance and Advisory, CohnReznick

The Small Business Administration (SBA) has released applications for the second round of Paycheck Protection Program (PPP) loans, as well as full information and guidance on who is eligible, how to apply, and more. Loans will soon be available both as “second-draw” loans for borrowers who received funding in the first round, and as “first-draw” loans to first-time borrowers.Current and prospective PPP borrowers will find that many of the guidelines on eligibility, forgiveness, and more have changed from the first to the second PPP round, which has a pool of over $284 billion and is included in the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act (Economic Aid Act) enacted Dec. 27, 2020.

With the new first-draw PPP loan applications and second-draw PPP loan applications available now, we recommend that interested businesses prepare now to apply as soon as their lenders indicate that they can, as funding for the initial wave of loans ran out quickly. Currently, the last day to apply for and receive a PPP loan of any kind – first- or second-draw – is March 31, 2021.

Read on for key information regarding the new and updated PPP provisions. Details are subject to change, so please check back for updates as more information becomes available. (SBA has specifically mentioned that they plan to issue “a consolidated rule governing all aspects of loan forgiveness and loan review.”) 

It’s also worth emphasizing that many of the various rules apply differently to different types of borrowers: first-time borrowers, second-time borrowers, borrowers whose first PPP loans have already been forgiven, certain industries and entity structures, and other groups within the PPP ecosystem. Reach out to our team or another trusted advisor to confirm the details of your particular case. 

A brief 'orientation'
Borrowers cannot receive more than one first-draw loan; an entity that received a first-draw loan in 2020 cannot apply for another in 2021, but may be eligible for a second-draw loan.

• If a borrower returned all of a first-draw PPP loan, they may reapply for a new first-draw loan in an amount they are eligible for under the current PPP rules.
• Borrowers that returned or repaid part of a first-draw loan can request an increase in their loan amount equal to the difference between the amount retained and the amount previously approved. 
• A borrower that did not accept the full amount of a first-draw loan they were approved for can request an increase up to the amount previously approved.
• Continue to the section “Loan increases and reapplications” for additional information for these borrowers.

A borrower may also only receive one second-draw loan.

If you have already received a first-draw loan, we recommend that you still read the first-draw section, as some first-draw terms have changed and may impact the borrower, such as the opportunity for increases in loan amounts, as well as additions to covered and forgivable expenses.

First-draw PPP loans and general PPP guidanceInformation in this section is drawn from the SBA Interim Final Rule (IFR) Business Loan Program Temporary Changes; Paycheck Protection Program as Amended by the Economic Aid Act. We have summarized key points, but in many cases you will find additional detail in the IFR.

ELIGIBILITY
To be eligible for a PPP loan in this round, a prospective borrower (together with any affiliates): 

1) Must have been in operation on Feb. 15, 2020; 
2) Must have had employees for which they paid salaries or payroll taxes, have paid independent contractors, or be an eligible self-employed individual, independent contractor, or sole proprietorship with no employees; and
3) Must be one of the following types of organizations:

• A “small business concern” under the applicable SBA revenue-based size standard for the applicant’s industry or the SBA alternative size standard (in brief: together with its affiliates, the entity must have a maximum tangible net worth of not more than $15 million; and its average net income after federal income taxes (excluding any carry-over losses) for the two full fiscal years before the application date must be not more than $5 million)  
• An independent contractor, eligible self-employed individual, or sole proprietor
• One of the following entities with no more than 500 employees (or a relevant SBA employee-based size standard; see Page 28 of the IFR for details)
  • A business concern
  • A 501(c)(3) tax-exempt nonprofit organization
  • A 501(c)(19) tax-exempt veterans organization
  • A tribal business concern as defined in the Small Business Act
• Housing cooperatives, certain 501(c)(6) organizations (excluding professional sports leagues and organizations with the purpose of promoting or participating in a political campaign or other activity), and eligible destination marketing organizations (the latter two groups subject to specified limitations on lobbying activity) with no more than 300 employees
• Certain news organizations: “A business concern, or any station which broadcasts pursuant to a license granted by the Federal Communications Commission under Title III of the Communications Act of 1934 (47 U.S.C. 301 et seq.), with more than one physical location that employs not more than 500 employees (or the size standard established by the Administrator for the NAICS code applicable to the business concern) per physical location, is eligible for a PPP loan if it: (1) is majority owned or controlled by a business concern that is assigned a NAICS code beginning with 511110 or 5151 or, with respect to a public broadcasting entity (as defined in section 397(11) of the Communications Act of 1934 (47 U.S.C. 397(11))), has a trade or business that falls under such a code.” This group must also make “a good-faith certification that proceeds of the loan will be used to support expenses at the component of the organization that produces or distributes locally focused or emergency information.” 

In most cases, a borrower will be considered together with its affiliates for purposes of determining eligibility. Affiliates are determined based on factors including (but not limited to) stock ownership, overlapping management, and identity of interest. Additional affiliate considerations for these PPP loans include:

• SBA affiliation rules are waived for NAICS code 72 (Accommodation and Food services) businesses with no more than 500 employees (300 for second-draw loans); franchises that are approved on SBA’s Franchise Directory; small businesses that receive financing through the Small Business Investment Company (SBIC) program; and select news and nonprofit organizations. See Page 15 of the IFR for details.  
• The number of employees in determining eligibility includes employees of any foreign affiliates; however, “under no circumstances may PPP funds be used to support non-U.S. workers or operations,” the IFR notes.
• Otherwise eligible faith-based organizations are exempt from SBA’s affiliation rules where they would “substantially burden those organizations’ religious exercise.”
• Portfolio companies of private equity funds are subject to affiliation rules; however, the IFR also reminds them that “all borrowers should carefully review the required certification on [the borrower application form] stating that ‘[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the applicant.’ ”
• Participation in an employee stock ownership program (ESOP) does not trigger application of affiliation rules.

In calculating employee counts, also consider:

• Independent contractors do not count as employees for the purpose of PPP loan calculations
• Student workers generally count as employees in PPP calculations; however, applicant institutions of higher education cannot include work-study students or payroll costs related to them in their calculations for eligibility and loan amounts.

Partnerships are eligible for PPP loans, but individual partners may not submit separate PPP loan applications for themselves as a self-employed individual. “Instead, the self-employment income of general active partners may be reported as a payroll cost, up to $100,000 on an annualized basis, as prorated for the period during which the payments are made or the obligation to make the payments is incurred on a PPP loan application filed by or on behalf of the partnership,” the IFR says. A partnership and its partners, and LLCs filing taxes as a partnership, are limited to one PPP loan. 

Seasonal employers were newly defined by the Economic Aid Act as an eligible recipient that:
1. “Does not operate for more than seven months in any calendar year;” OR
2. “During the preceding calendar year, had gross receipts for any six months of that year that were not more than 33.33 percent of the gross receipts of the employer for the other six months of that year.”
The IFR says that seasonal businesses will be considered as meeting the “in operation as of Feb. 15, 2020” requirement if they were in operation for any 12-week period between Feb. 15 of 2019 and 2020.

The following entities are eligible provided that they meet the other eligibility requirements:

• Hospitals owned by state or local government (both businesses and tax-exempt nonprofits), provided they receive less than 50% of their funding from state or local government sources (exclusive of Medicaid)
• Businesses that receive legal gaming revenue
• Electric and telephone cooperatives that are exempt from federal income taxation under Section 501(c)(12) (subject to specified size standards)

The following are ineligible even if they meet the other requirements:

• Any prospective borrower that engaged in any activity that is illegal under federal, state, or local law
• Household employers (i.e., individuals employing nannies or housekeepers)
• Applicants with an owner of 20% or more of equity who is incarcerated, subject to formal criminal charges, or in other circumstances related to certain felonies; see Page 24 of the IFR for full details
• Applicants that themselves, or any business owned or controlled by them or any of their owners, “have ever obtained a direct or guaranteed loan from SBA or any other Federal agency that is currently delinquent or has defaulted within the last seven years and caused a loss to the government”
• Businesses that were not in operation on Feb. 15, 2020
• Businesses that are permanently closed
• Businesses that have received or will receive a grant under the new Shuttered Venue Operator Grant program included in the Economic Aid Act
• Businesses for which a controlling interest is held by the president, vice president, the head of an executive department, a member of Congress, or a spouse of such person (Businesses in this category that received loans made before Dec. 27, 2020, must disclose that information to SBA, in some cases no later than Jan. 26, 2021; see Page 25 of the IFR for details)
• Issuers with securities listed on registered national securities exchanges 
• The applicant or its owner is the debtor in a bankruptcy proceeding
• Hedge funds and private equity firms

See Page 26 of the IFR for details on whether businesses that are generally ineligible for 7(a) loans under 13 CFR 120.110 are eligible for PPP loans. 

FIRST-DRAW LOAN MAXIMUM LOAN SIZE
Businesses can apply for the lesser of:

• Maximum loan size of $10 million or
• A calculated amount based on 2.5 times the average total monthly payroll costs during either calendar year 2019; the calendar year 2020; or the one-year period before the date the loan is made. In general, this calculation is as follows:
  • Aggregate eligible payroll costs from the chosen period for employees whose principal place of residence is in the U.S.
  • “Subtract any compensation paid to an employee in excess of $100,000 on an annualized basis, as prorated for the period during which the payments are made or the obligation to make the payments is incurred.”
  • Divide this amount by 12 to get average monthly payroll costs
  • Multiply by 2.5
  • “Add the outstanding amount of an Economic Injury Disaster Loan (EIDL) made between Jan. 31, 2020, and April 3, 2020, that you seek to refinance”; do not include the amount of any EIDL COVID-19 loan advance.
• Additional special calculation methods and documentation requirements are outlined for individuals with self-employment income (with and without employees); seasonal employers; farmers and ranchers (with and without employees); and partnerships. 

Reference period: The CARES Act  stated that borrowers should calculate their maximum loan amount using “payroll costs incurred during the one-year period before the date on which the loan is made,” so most 2020 borrowers used 2019. The IFR allows new borrowers who obtain first-draw loans in 2021 to use either 2019 or 2020 to calculate their maximum loan amount, at their election, so that they can “obtain funding on terms commensurate with existing PPP borrowers” and “do not see their permissible loan amounts reduced due to financial distress experienced in 2020.” (Farmers and ranchers are included in this flexibility, which does not otherwise impact loan terms, processes, and procedures.)

Businesses that are part of a single corporate group – defined for this purpose as businesses that “are majority owned, directly or indirectly, by a common parent” – in no event can receive more than $20 million in the aggregate. Applicants that have applied for or received more than that amount must notify their lender and withdraw or request cancellation of any noncompliant pending PPP loan application or approved PPP loan. “Failure by the applicant to do so will be regarded as a use of PPP funds for unauthorized purposes, and the loan will not be eligible for forgiveness,” the IFR states.

• Note that this limitation applies even if the business is eligible for a CARES Act waiver of SBA’s affiliation rules or otherwise not considered an affiliate under those rules.

DOCUMENTATION AND CERTIFICATIONS
Applicants will be required to provide payroll records, evidence of retirement and health insurance contributions, and other documentation from each quarter in the chosen period, as well as documentation from the pay period that included Feb. 15, 2020, to establish that they were in operation at that time.

In case of SBA review or audit, borrowers of all sizes should pay close attention to the IFR’s guidance for retaining records related to their spending and other compliance with PPP requirements.

Prospective borrowers will be required to make the following good-faith certifications on their applications indicating that they have met or will meet various program requirements. 

• “The applicant was in operation on Feb. 15, 2020, has not permanently closed, and was either an eligible self-employed individual, independent contractor, or sole proprietorship with no employees, or had employees for whom it paid salaries and payroll taxes or paid independent contractors, as reported on a Form 1099-MISC.”
• “Current economic uncertainty makes this loan request necessary to support the ongoing operations of the applicant.” (However, note that the safe harbor introduced in May 2020 will also still apply: “Any PPP borrower, together with its affiliates, that received PPP loans with an original principal amount of less than $2 million will be deemed to have made the required certification concerning the necessity of the loan request in good faith.”)
• “The funds will be used to retain workers and maintain payroll; or make payments for mortgage interest, rent, utilities, covered operations expenditures, covered property damage costs, covered supplier costs, and covered worker protection expenditures as specified under the Paycheck Protection Program Rules; I understand that if the funds are knowingly used for unauthorized purposes, the federal government may hold me legally liable such as for charges of fraud. (As explained above, not more than 40 percent of loan proceeds may be used for nonpayroll costs.)”
• “I understand that loan forgiveness will be provided for the sum of documented payroll costs, covered mortgage interest payments, covered rent payments, covered utilities, covered operations expenditures, covered property damage costs, covered supplier costs, and covered worker protection expenditures, and not more than 40% of the forgiven amount may be for non-payroll costs. If required, the Applicant will provide to the Lender and/or SBA documentation verifying the number of full-time equivalent employees on the Applicant’s payroll as well as the dollar amounts of eligible expenses for the covered period following this loan.”
• The Applicant has not and will not receive another loan under the Paycheck Protection Program, or a Shuttered Venue Operator grant from SBA.
• “The president, the vice president, the head of an executive department, or a member of Congress, or the spouse of such person as determined under applicable common law, does not directly or indirectly hold a controlling interest in the Applicant, with such terms having the meanings provided in Section 322 of the Economic Aid to Hard-Hit Small Businesses, Nonprofits, and Venues Act.”  
• “The Applicant is not an issuer, the securities of which are listed on an exchange registered as a national securities exchange under Section 6 of the Securities Exchange Act of 1934 (15 U.S.C. 78f).”
• “I further certify that the information provided in this application and the information provided in all supporting documents and forms is true and accurate in all material respects.” (The applicant also certifies in this item to understanding of penalties for false statements.) 
• “I acknowledge that the lender will confirm the eligible loan amount using required documents submitted. I understand, acknowledge, and agree that the lender can share the tax information with SBA’s authorized representatives, including authorized representatives of the SBA Office of Inspector General, for the purpose of compliance with SBA Loan Program Requirements and all SBA reviews.”

PAYROLL COSTS 
Payroll costs are defined as including:

• Compensation to employees (whose principal place of residence is the U.S.) in the form of salary, wages, commissions, or similar compensation. Independent contractors do not count as employees for purposes of PPP loan calculations.
• Cash tips or the equivalent (based on employer records of past tips or, in the absence of such records, “a reasonable, good-faith employer estimate of such tips”)
• Payment for vacation, parental, family, medical, or sick leave
• Allowance for separation or dismissal
• Payment for the provision of employee benefits consisting of group health care or group life, disability, vision, or dental insurance, including insurance premiums, and retirement
• Payment of state and local taxes assessed on compensation of employees
• For an independent contractor or sole proprietor, wages, commissions, income, or net earnings from self-employment, or similar compensation

Expressly excluded under the act are:

• Compensation to employees whose principal place of residence is outside the U.S.
• “The compensation of an individual employee in excess of $100,000 on an annualized basis, as prorated for the period during which the payments are made or the obligation to make the payments is incurred”
• Federal employment taxes imposed or withheld during the selected period, including both the employee’s and the employer’s share of FICA (Federal Insurance Contributions Act) and Railroad Retirement Act taxes, and income taxes required to be withheld from employees
• Qualified sick and family leave wages for which a credit is allowed under Sections 7001 and 7003 of the March 2020 Families First Coronavirus Response Act (FFCRA)

LOAN INCREASES AND REAPPLICATIONS
The IFR and subsequently released SBA guidance establish that the following borrowers can work with their “Lender of Record” – the lender reflected in SBA’s system as the current owner of the first-draw loan – to request loan increases. These increases can be made even if their loan has already been disbursed, but not if SBA has remitted a forgiveness payment. (Lenders are permitted to make additional disbursements for the increased amount.) Requests must be submitted on or before March 31, 2021, and will be subject to availability of funds. For more details and instructions, see Pages 74-76 of the IFR and SBA’s Jan. 13 Procedural Notice. (Lenders, see the Procedural Notice for guidance on submitting, reporting, and disbursing these requests and amounts.)

• Partnerships that received PPP loans that did not include any compensation for their partners can request an increase to include “appropriate partner compensation.”
• Seasonal employers that received loans before Dec. 27, 2020, and are now eligible for a higher maximum loan amount under the Economic Aid Act’s new calculation can request an increase to that higher amount.
• Farmers and ranchers whose maximum loan amount calculation changed under the new legislation can request an increase if the new formula makes them eligible for a higher amount. 

Note that these increased amounts cannot exceed the maximum loan amount the borrower is entitled to, and cannot exceed $10 million for individual borrowers or $20 million for a corporate group. 

Also, as noted earlier, borrowers that repaid or did not accept all or part of their first-draw loan may be eligible to reapply for new first-draw loans or request an increase. In such cases, the lender must have reported the repayment or rejection to SBA before Dec. 27, 2020, and SBA must have not yet remitted a forgiveness payment.

• If a borrower fully repaid their loan, the borrower may reapply for a new first-draw loan in an amount they are eligible for under the current PPP rules. The reapplication process depends on whether the lender reported the first-draw loan as “canceled” or “paid in full”; see Pages 4-5 of the Procedural Notice for details.
• Borrowers that returned or repaid part of their first-draw loan can request an amount equal to the difference between the amount retained and the amount previously approved.
• Borrowers that did not accept the full loan amount they were approved for can request an increase in their loan amount up to the amount previously approved.

LOAN TERMS
PPP loans will generally be guaranteed under the same terms, conditions, and processes as other 7(a) loans, though there are changes including (but not limited to):

• Guarantee percentage: 100%
• No collateral or personal guarantees will be required
• Interest rate: 100 basis points or 1%, calculated on a non-adjustable, non-compounding basis
• Maturity: Five years
• Lenders will not be required to apply the “credit elsewhere test”
• Repayment
• Borrowers that submit a forgiveness application within 10 months of the end of their forgiveness covered period (see below) do not have to make any payments of principal or interest before the date on which SBA remits the forgiveness amount to their lender (or notifies the lender that no forgiveness has been allowed). Lenders must inform borrowers of those events and the date their first payment is due.
  • The covered period is now defined as “the period beginning on the date the lender disburses the PPP loan and ending on any date selected by the borrower that occurs during the period (i) beginning on the date that is eight weeks after the date of disbursement and (ii) ending on the date that is 24 weeks after the date of disbursement.”
• If a borrower has not submitted a forgiveness application within that time frame (covered period plus 10 months), they must begin making payments on or after the last date of that time frame.
• Note that interest continues to accrue during while payment is deferred.

Additionally, “All loans will be processed by all lenders under delegated authority and lenders will be permitted to rely on certifications of the borrower in order to determine eligibility of the borrower and the use of loan proceeds,” the IFR states.

Borrowers may not take multiple loan draws to delay the start of their covered period. The IFR states, “The lender must make a one-time, full disbursement of the PPP loan within 10 calendar days of loan approval; for the purposes of this rule, a loan is considered approved when the loan is assigned a loan number by SBA.”

LOAN FORGIVENESS
Like in the first round, new first-draw PPP loans are again forgivable up to the full principal amount of the loan and any accrued interest. “An eligible borrower will not be responsible for any loan payment if the borrower uses all of the loan proceeds for forgivable purposes and employee and compensation levels are maintained or, if not, an applicable safe harbor or exemption applies,” the IFR states.

The covered period is now defined as “the period beginning on the date the lender disburses the PPP loan and ending on any date selected by the borrower that occurs during the period (i) beginning on the date that is eight weeks after the date of disbursement and (ii) ending on the date that is 24 weeks after the date of disbursement.”

With this new guidance, permissible expenses have been expanded – from the defined payroll costs and qualified rent, utilities, mortgage interest, and other interest payments – to also include:

• Certain employer-provided group insurance payments: “Costs related to the continuation of group health care, life, disability, vision, or dental benefits during periods of paid sick, medical, or family leave, and group health care, life, disability, vision, or dental insurance premiums”
• Refinancing of SBA EIDL loans made between Jan. 31 and April 3 of 2020
• Covered operations expenditures: “Payments for any business software or cloud computing service that facilitates business operations, product or service delivery, the processing, payment, or tracking of payroll expenses, human resources, sales and billing functions, or accounting or tracking of supplies, inventory, records and expenses”
• Covered property damage costs: Costs related to “property damage and vandalism or looting due to public disturbances that occurred during 2020 that was not covered by insurance or other compensation”
• Covered supplier costs: Payments made to suppliers of goods pursuant to contracts, orders, or purchase orders in effect before the covered period (or, for perishable goods, in effect before or during the covered period), for the supply of goods that “are essential to the operations of the borrower at the time at which the expenditure is made”
• Covered worker protection expenditures: Expenditures made to help the business comply with federal, state, or local requirements or guidelines related to worker and customer safety amid COVID-19, such as the purchase of PPE or facility modifications such as ventilation and filtration systems, physical barriers, and screening capabilities; see Page 50 of the IFR for additional details and examples
• Note that borrowers that received PPP loans before, on, or after the date the Economic Aid Act was enacted – Dec. 27, 2020 – are allowed to use the expanded permissible expenses, unless their loans were already forgiven.

The IFR states: 
“At least 60% of the PPP loan proceeds shall be used for payroll costs. For purposes of determining the percentage of use of proceeds for payroll costs, the amount of any EIDL refinanced will be included. For purposes of loan forgiveness, however, the borrower will have to document the proceeds used for payroll costs in order to determine the amount of forgiveness. While the Act provides that PPP loan proceeds may be used for the purposes listed above and for other allowable uses described in section 7(a) of the Small Business Act (15 U.S.C. 636(a)), the Administrator believes that finite appropriations and the structure of the Act warrant a requirement that borrowers use a substantial portion of the loan proceeds for payroll costs, consistent with Congress’ overarching goal of keeping workers paid and employed. This percentage is consistent with the limitation on the forgiveness amount set forth in the Flexibility Act. This limitation on use of the loan funds will help to ensure that the finite appropriations available for these loans are directed toward payroll protection, as each loan that is issued depletes the appropriation, regardless of whether portions of the loan are later forgiven.”

Additional considerations regarding forgivable costs and forgiveness amounts include:

• Individuals with self-employment income are subject to additional provided guidance on how loan proceeds can be used; see Page 52 of the IFR for information.
• Loan proceeds cannot be used for lobbying activities or expenditures.
• Payroll costs that are qualified wages taken into account in determining the CARES Act’s Employee Retention Credit are not eligible for forgiveness.
• Borrowers that also received SBA Economic Injury Disaster Loan Advances no longer need to subtract such advances from their PPP forgiveness, and SBA will no longer deduct those amounts from the forgiveness payment remitted to the PPP lender. “Any EIDL Advance Amounts previously deducted from a borrower’s forgiveness amount will be remitted to the lender, together with interest to the remittance date,” the IFR states.

Borrowers that are found to have used PPP funds for unauthorized purposes not only will have to repay those amounts, but may also be subject to additional liability such as charges for fraud. Shareholders, members, and partners can face SBA recourse for any unauthorized use they commit.

SBA issued a simplified forgiveness application in October for borrowers with loans of $50,000 or less. The new legislation and guidance simplifies the forgiveness application process for loans up to $150,000; we will provide more information as application materials become available.

Second-draw PPP loansThe second-draw loans created by the Economic Aid Act are smaller PPP loans available to certain borrowers that received previous, first-draw PPP loans. Many of the same terms, conditions, and processes of first-draw PPP loans apply for second-draw PPP loans; still, there are a number of key differences and exceptions, which are specified in a second IFR, Paycheck Protection Program (PPP) Second-Draw Loans. Read on for an overview of key ones to know, and see the IFR for complete information.

ELIGIBILITY
A second-draw borrower can be a business concern, independent contractor, eligible self-employed individual, sole proprietor, nonprofit organization eligible for a first-draw PPP Loan, veterans organization, tribal business concern, housing cooperative, small agricultural cooperative, eligible 501(c)(6) organization or destination marketing organization, or an eligible nonprofit news organization, with all terms defined as they are in the first-draw IFR. 

They must have used or have plans to use their first-draw loan’s full amount on or before the date of disbursement of the second-draw loan.

• “Full amount” includes any loan increase as described above.
• The full amount must have been spent on authorized PPP uses.

Eligibility requirements are narrower; in addition to meeting the first-draw requirements, second-draw borrowers must:

• Have no more than 300 employees (or, for NAICS code 72 businesses (Accommodation and Food Services) or eligible news organizations with more than one location, 300 or fewer per location)
• Demonstrate at least a 25% reduction in gross receipts (further defined below) in 2020, calculated by comparing quarterly gross receipts for one quarter in 2020 with those for the corresponding 2019 quarter
  • Alternatively, so that borrowers can substantiate this revenue reduction with their annual tax return forms, a borrower that was in operation in all four quarters of 2019 can also be deemed to have experienced this reduction if 1) it experienced a reduction in annual receipts of 25% or greater in 2020 compared to 2019 and 2) it submits copies of those annual tax forms.
  • Specific guidance is provided for applicants that were not in operation all four 2019 quarters, based on when they were in operation – see Page 21 of the IFR for information. 
  • Applicants that were not in operation in 2019 but were on Feb.  15, 2020, can demonstrate this reduction between 1) Q1 of 2020 and 2) Q2, Q3, or Q4 of 2020.

Certain entities are also specifically excluded from second-draw loans:

• Entities that have permanently closed; those temporarily closed or suspended remain eligible
• “A business concern or entity primarily engaged in political activities or lobbying activities … including any entity that is organized for research or for engaging in advocacy in areas such as public policy or political strategy or otherwise describes itself as a think tank in any public documents;
• “Certain entities organized under the laws of the People’s Republic of China or the Special Administrative Region of Hong Kong, or with other specified ties to the People’s Republic of China or the Special Administrative Region of Hong Kong;
• “Any person required to submit a registration statement under Section 2 of the Foreign Agents Registration Act of 1938 (22 U.S.C. 612);
• “A person or entity that receives a grant for shuttered venue operators under Section 324 of the Economic Aid Act;”
• Entities in which the president, the vice president, the head of an executive department, or a member of congress, or the spouse of such a person, directly or indirectly owns, controls, or holds a controlling interest in the entity (at least 20% of any class of equity interest, by vote or value); or
• “A publicly traded company, defined as an issuer, the securities of which are listed on an exchange registered as a national securities exchange under Section 6 of the Securities Exchange Act of 1934 (15 U.S.C. 78f).”

GROSS RECEIPTS
The second-draw IFR includes specific definitions and rules for what constitutes “gross receipts.”

• Gross receipts do include: “All revenue in whatever form received or accrued (in accordance with the entity’s accounting method) from whatever source, including from the sales of products or services, interest, dividends, rents, royalties, fees, or commissions, reduced by returns and allowances.”
• Gross receipts excludes: 
  • “Taxes collected for and remitted to a taxing authority if included in gross or total income (such as sales or other taxes collected from customers and excluding taxes levied on the concern or its employees); 
  • “Proceeds from transactions between a concern and its domestic or foreign affiliates; and 
  • “Amounts collected for another by a travel agent, real estate agent, advertising agent, conference management service provider, freight forwarder or customs broker.”
  • The amount of any first-draw loan 
  • Net capital gains or losses as these terms are defined and reported on IRS tax return forms
• “All other items, such as subcontractor costs, reimbursements for purchases a contractor makes at a customer's request, investment income, and employee-based costs such as payroll taxes, may not be excluded from gross receipts,” the IFR states.
• Affiliates: Specific guidance is provided for borrowers with affiliates and borrowers that acquired or were acquired by affiliate during 2020; gross receipts of former affiliates are not included.
• Eligible nonprofit, veterans, nonprofit news, 501(c)(6), and destination marketing organizations should use the gross receipts definition in IRC Section 6033.

AFFILIATION RULES
Affiliation rules for second-draw loans are the same as for first-draw loans, but waived for:

• NAICS code 72 business concerns with not more than 300 employees
• NAICS code 5151 nonprofit organizations
• “Any business concern (including any station which broadcasts pursuant to a license granted by the Federal Communications Commission under title III of the Communications Act of 1934 (47 U.S.C. 301 et seq.) without regard for whether such a station is a concern as defined in 13 C.F.R. Section 121.105, or any successor thereto) that employs not more than 300 employees, per physical location of such business concern and is majority owned or controlled by a business concern that is assigned a NAICS code beginning with 511110 or 5151”

SECOND PPP DRAW – MAXIMUM LOAN AMOUNT
​The maximum loan amount is smaller for second-draw loans. In general, borrowers can apply for the lesser of:

• Maximum loan size of $2 million (down from $10 million for first-draw loans), or
• 2.5 times the average total monthly payroll costs during either calendar year 2019; calendar year 2020; or the one-year period before the date the loan is made. 
• Tailored calculations and considerations are provided for certain borrower groups (see pages 28-32 of the IFR):
  • NAICS code 72 entities may receive up to 3.5 times their average monthly payroll figure
  • Borrowers that did not exist during the one-year period preceding Feb. 15, 2020
  • Borrowers with self-employment income
  • Partnerships
  • Seasonal employers
  • Farmers and ranchers
  • Self-employed individuals and partnerships
    • Generally, these last two groups follow the methodologies used for first-draw loans, just “adjusted to eliminate the provision for refinancing of an EIDL loan, which does not apply to second-draw PPP loans, and to apply the choice of time period for calculating payroll costs, consistent with other second-draw PPP loans.”
• Businesses that are part of a single corporate group – defined for this purpose as businesses that “are majority owned, directly or indirectly, by a common parent” – in no event can receive more than $4 million in the aggregate. 

DOCUMENTATION AND CERTIFICATIONSWhile second-draw loan applications generally will require the same documentation as first-draw loans, no additional documentation to substantiate payroll costs will be required if the applicant used calendar year 2019 figures to determine both their first- and second-draw loan amounts, and is going through the same lender for both loans. (However, lenders can request additional documentation.)
Second-draw applicants are also subject to additional documentation requirements to establish that they experienced the required revenue reduction; see Page 15 of the IFR for details and examples. Submission for that documentation varies: 

• Loan principal amounts greater than $150,000: Due with the loan application
• $150,000 or less: Due on or before the date the borrower applies for forgiveness
• If the borrower does not apply for loan forgiveness, this documentation must be provided upon SBA’s request.

There are also several additional certifications for second-draw borrowers related to their various additional requirements.

• “… The applicant must certify that the applicant has not and will not receive another Second Draw Paycheck Protection Program Loan; and
• “The applicant has realized a reduction in gross receipts in excess of 25% relative to the relevant comparison time period. For loans greater than $150,000, applicant has provided documentation to the lender substantiating the decline in gross receipts. For loans of $150,000 or less, applicant will provide documentation substantiating the decline in gross receipts upon or before seeking loan forgiveness for the Second-Draw Paycheck Protection Program Loan or upon SBA request.”
• “The applicant received a First-Draw Paycheck Protection Program Loan and, before the Second-Draw Paycheck Protection Program Loan is disbursed, will have used the full loan amount (including any increase) of the First-Draw Paycheck Protection Program Loan only for eligible expenses.”
• “The Applicant is not a business concern or entity (a) for which an entity created in or organized under the laws of the People’s Republic of China or the Special Administrative Region of Hong Kong, or that has significant operations in the People’s Republic of China or the Special Administrative Region of Hong Kong, owns or holds, directly or indirectly, not less than 20% of the economic interest of the business concern or entity, including as equity shares or a capital or profit interest in a limited liability company or partnership; or (b) that retains, as a member of the board of directors of the business concern, a person who is a resident of the People’s Republic of China.”
• “The applicant is not required to submit a registration statement under Section 2 of the Foreign Agents Registration Act of 1938 (22 U.S.C. 612).”
• “The applicant is not a business concern or entity primarily engaged in political or lobbying activities, including any entity that is organized for research or for engaging in advocacy in areas such as public policy or political strategy or otherwise describes itself as a think tank in any public documents.”

UNRESOLVED ISSUES WITH FIRST-DRAW LOANSIf a borrower’s first-draw loan is under review, and/or the SBA has information indicating that they may have been ineligible for that loan or loan amount, the SBA will notify the lender when the lender submits the second-draw guaranty application. In such a case, the lender will not receive an SBA loan number until (and if) the SBA resolves the issue.
LOAN FORGIVENESSForgiveness terms and conditions are the same for second-draw loans as for first-draw loans, with the only additional requirement (at this time) being that, as mentioned above, borrowers with a principal amount of $150,000 or less must provide the required revenue reduction documentation with their forgiveness application if they did not do so with their loan application.
What does CohnReznick think?The very first round of PPP funding ran out quickly, so acting prudently and expeditiously  may boost your chances of a successful application. Contact our PPP team for assistance, and find full details and updated application materials on the SBA website.

By Michelle A. Schaap, Chiesa Shahinian & Giantomasi PC
 
In December, we learned that the SolarWinds Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1*, released between March 2020 and June 2020, were compromised by an advanced persistent threat actor (or APT). The perpetrators of this sophisticated attack implanted a Trojan into a legitimate update to the Orion Platform that was released in March. Once the Trojan was activated, it allowed the threat actor to not only have high level credentials into the Orion Platform, but to potentially move across other areas of the compromised target’s network and systems.
 
Until recently, the SolarWinds’ site listed representative clients, including such companies as CISCO, AT&T, Ford Motor Company and all five top US accounting firms, to name a few. Its federal (government) clients include all five branches of the US Military, the US Pentagon, State Department, the Treasury Department, NASA, and NSA. Many local governments also use SolarWinds’ products.
 
If a firm was using the impacted SolarWinds Orion platform, that does not necessarily mean that the malware had been activated. DHS and CISA both recommend that businesses concerned that they may have been impacted should:

• Mirror impacted systems to preserve forensic data for further investigation
• Deactivate the platform
• Retain the services of a firm with expertise in cyberthreat hunting to actively look for anomalies in the business’ systems and networks
• Change all passwords and account credentials
• Implement multifactor authentication
• For firms currently using 128-bit encryption, upgrade to 256-bit encryption
• To the extent that the Orion Platform was part of an entity's cyber risk management strategy, alternative processes and procedures should be implemented.

 
It is important to follow specific steps in working to investigate, eradicate and rebuild/restore impacted systems.
 
Please see the CISA website for the most up-to-date guidance and information. As of, January 7, 2021, this link provides the most up-to-date information from CISA: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations | CISA
 
While SolarWinds released two hot patches the week of December 14, 2020, as of the day of this writing, DHS and CISA continue to recommend that firms exercise caution in applying the patches and restoring or continuing to run the Orion Platform. To be clear, CISA and DHS mandated that all impacted federal agencies had to update their Orion instances by December 31, 2021. Note also that FireEye released a kill switch that was reported to stop the continued attack. However, impacted entities will have a long road to restore impacted systems and determine what was already compromised. As CISA has repeatedly advised in its updates, restoring impacted systems and removing all traces of malware is not a simple task.
 
Prior to the New Year, a further vulnerability in SolarWinds’ Orion product was reported by Carnegie Mellon. The report indicated that the Orion API authentication bypass can allow a hacker to remotely execute commands. While there is a patch available to address this, we recommend caution still as further vulnerabilities in the product may come to light in the coming weeks.
 
Rumors were circulating that Microsoft’s cloud environment had been compromised, too, as a result of the Orion Trojan. CISA and DHS explained in a briefing on Friday, December 18, 2020, that Microsoft Cloud was not compromised. However, the Trojan hidden in the Orion March 2020 upgrade allowed the bad actors to steal credentials to impacted entities’ other accounts – including Microsoft Cloud access credentials. With the legitimate (stolen) credentials, the bad actors were able to access data in entities’ Microsoft cloud accounts.
 
Potentially impacted firms are advised to examine their active directories in their Microsoft account for anomalous activity.
 
In CISA/DHS’s latest update, they highlighted another problem with the Orion compromise. Because of the access within a company’s systems that the Orion product needed for it to properly function, it allowed bad actors to take over administrative level credentials potentially giving hackers “God access" or a "God door" to impacted systems. What this means is that not only could the hackers compromise systems that the Orion product interacted with, but would allow hackers to migrate throughout an infected system and access other tools, programs, etc. In short, omni-access, if you will. As such, eradicating these hackers will require companies where the trojan was deployed to carefully assess all systems and tools used in their networks.
 
Business emails of high level officials and roles within an organization have been observed as particular targets of the APT. As such, refresher training of personnel to heighten awareness of business email compromises are in order.
 
Even if your entity was not running one of the impacted products, check with key vendors to ascertain whether they were impacted. If so, either their access to your systems may have been compromised and/or their ability to provide their services to your organization may be impacted.
 
Other Notables and Tips:

• Cloud instances of Orion only monitor cloud resources; and on-premises Orion only monitor on-premises – again isolating the instances.
• If you rebuild, do a collective restore with a new instance – not just a patch.
• Update and upgrade software immediately.
• MONITOR!!! Look for anomalous activity

 
If you have questions regarding the foregoing, or would like referrals to additional resources, please contact your attorney or the author of this blog post, Michelle A. Schaap of Chiesa Shahinian & Giantomasi PC’s Privacy & Data Security Group.
 
*Impacted Products:

• Orion Platform 2019.4 HF5, version 2019.4.5200.9083
• Orion Platform 2020.2 RC1, version 2020.2.100.12219
• Orion Platform 2020.2 RC2, version 2020.2.5200.12394
• Orion Platform 2020.2, 2020.2 HF1, version 2020.2.5300.12432

 

By: NPZ Law Group P.C.

​U.S. Citizenship and Immigration Services has announced a final rule that will modify the H-1B cap selection process, amend current lottery procedures, and prioritize wages to protect the economic interests of U.S. workers and better ensure the most highly skilled foreign workers benefit from the temporary employment program.

Modifying the H-1B cap selection process will incentivize employers to offer higher salaries, and/or petition for higher-skilled positions, and establish a more certain path for businesses to achieve personnel needs and remain globally competitive.

“The H-1B temporary visa program has been exploited and abused by employers primarily seeking to fill entry-level positions and reduce overall business costs,” said USCIS Deputy Director for Policy Joseph Edlow. “The current H-1B random selection process makes it difficult for businesses to plan their hiring, fails to leverage the program to compete for the best and brightest international workforce, and has predominately resulted in the annual influx of foreign labor placed in low-wage positions at the expense of U.S. workers.”

This effort will only affect H-1B registrations (or petitions, if the registration process is suspended) submitted by prospective petitioners seeking to file H-1B cap-subject petitions. It will be implemented for both the H-1B regular cap and the H-1B advanced degree exemption, but it will not change the order of selection between the two as established by the H-1B registration final rule.

The final rule will be effective 60 days after its publication in the Federal Register. DHS previously published a notice of proposed rulemaking on Nov. 2, 2020, and carefully considered the public comments received before deciding to publish the proposed regulations as a final rule.

If you should have any questions about the H-1B process or need more information about the ways in which the U.S. and Canadian Immigration and Nationality Laws may impact you, your family, your friends or your colleagues, please contact us at the NPZ Law Group – VISASERVE – U.S. and Canadian Immigration and Nationality Lawyers by e-mailing us at [email protected] or by calling us at 201-670-0006 (x104). You can also visit us online at NPZ Business Immigration Lawyers