Correct. Typically bills will direct a regulatory agency (like the CFPB) to create regulatory requirements and enforce after an effective date is established.
I work in banking compliance. I reviewed CARES to help lenders build a software application to process PPP apps online. Business lending in general has very little supervision. CARES did not add to this (Section 1102 of H.R. 748). Additionally, the SBA did not outline a process on how to process applications. The SBA only provided minimal guidelines to apply and process requests. It is kind of like the Wild West.
Another round of funding was just approved by the Senate and is expected to pass the House later this week. I believe that this round of funding will be spread out based on asset size. So if you are a smaller bank (under 10 billion in assets) you will get X dollars. 10-50 billion in assets gets X amount. This may help stem-off large banks dipping into funds, but won't solve the issue of how community banks and credit unions spread loan funds around.
My opinion is that the SBA should put in place certain processes to make things more transparent to the public before turning E-Tran back on to process applications. Reporting on PPP activity should be mandatory and made public as well. Having regulatory enforcement would be good and probably will happen in the future for business lending, but to establish an agency or direct a current one to take on enforcement is a massive effort.