Criminal Defense Lawyers

How Long Should You Keep Your PPP Loan Records? 10 Years, Not 6

How Long Should You Keep Your PPP Loan Records? 10 Years, Not 6

The official answer to this question is 6 years. The right answer is 10 years. And that differance could mean everything if you ever need to defend yourself against a federal investigation.

If your reading this because your thinking about cleaning out old business files and wondering weather you can finally get rid of that PPP loan paperwork, I need you to pump the brakes for a minute. The SBA technically says borrowers should keep records for 6 years after forgiveness or payoff. But that official requirement was set before Congress extended the fraud statute of limitations to 10 years. If you destroy your records after 6 years and then get investigated in year 7, 8, or 9, you’ll have no documentation to prove your innocence—and you might face additional charges for destroying evidence.

This article is going to explain why the official 6-year requirement isn’t enough to protect you, what specific documents you need to keep, how to store them safely for a decade, and when you can finally, definitively destroy them without worry.

I know nobody wants to hear that they need to keep old paperwork around for another decade. Filing cabinets are full, hard drives are cluttered, and there’s something psychologically satisfying about getting rid of stuff you dont need anymore. But these aren’t ordinary business records—their potentially exculpatory evidence in a federal investigation that could happen years from now. The slight inconvienence of keeping them is nothing compared to the disaster of needing them and not having them.

Why 6 Years Isn’t Enough: The Regulatory Disconnect Nobody Talks About

Lets start with the confusing regulatory landscape, because understanding this is critical to protecting yourself.

When the PPP program was created in 2020, the SBA established record retention requirements for borrowers. If you got a loan over $150,000, you were supposed to keep records for 6 years after forgiveness or repayment. If you used the simplified Form 3508S for smaller loans, the requirement was even shorter—4 years for employment records and 3 years for everything else. These requirements seemed reasonable at the time.

But then something changed that most people never heard about. In August 2022, Congress passed the PPP and Bank Fraud Enforcement Harmonization Act, which extended the statute of limitations for PPP fraud from 5-6 years to 10 years. This meant the goverment suddenly had a much longer window to investigate and prosecute fraud.

Here’s where it gets really interesting. In August 2024, the SBA issued an interim final rule extending the record retention requirement for lenders to 10 years. The SBA explicitly said this change was made to align with the extended fraud statute of limitations. Makes sense, right? If the goverment can prosecute fraud for 10 years, lenders should keep records for 10 years.

But here’s the thing—the SBA updated the requirement for lenders but hasn’t formally updated the requirement for borrowers. The official borrower requirement is still technically 6 years. This creates a dangerous gap where borrowers might think its safe to destroy records after 6 years, even though the goverment can still prosecute them for another 4 years after that.

Think about what that means practically. You got your PPP loan in April 2020. Six years later, in April 2026, you decide its time to clean out those old files. Everything’s forgiven, you haven’t heard from anyone, seems safe. So you shred the documents, delete the files, and move on with your life.

Then in 2028—eight years after you got the loan—the FBI shows up asking questions about your PPP application. Maybe a whistleblower came forward. Maybe data analytics flagged something. Doesn’t matter why. What matters is that the goverment still has untill 2030 to charge you with fraud, and you just destroyed all the evidence you would of used to defend yourself.

The 10-year fraud statute exists. The goverment has 10 years to prosecute. You should keep your records for 10 years. Period.

I want to be really clear about why this matters so much. The records you keep aren’t just bureaucratic compliance—their your insurance policy. Their the evidence that proves you did everything right, or at least that you had reasonable basis for what you did. If you ever need to explain your PPP loan to federal investigators, those records are how you tell your story. Without them, you’re defenseless.

Think of it this way: if a fire destroyed all your records tomorrow, that would be unfortunate but understandable. Investigators and prosecutors know that accidents happen, and they generally don’t hold it against people when records are lost through no fault of their own. But if you deliberately destroyed those same records because you thought you didn’t need them anymore, and then it turns out you actually did need them? That’s a completley different situation—and potentially a much worse one from a legal standpoint. Intentional destruction of potentially relevant records can be used against you in ways that accidental loss typically cannot.

What Happens If You Destroy Records Too Early

Destroying your PPP loan records before the 10-year window closes isn’t just a bad idea—it could actually get you into more trouble then the underlying fraud ever would.

Under 18 U.S.C. 1519, destroying records in connection with a federal investigation or bankruptcy case is a federal crime called obstruction of justice. If you destroy documents that are relevant to a federal investigation—even if you didn’t know you were under investigation when you destroyed them—you could face additional charges on top of whatever fraud charges might be coming. Obstruction carries up to 20 years in federal prison, which is often more then the underlying offense prosecutors were originally investigating.

Now, I’m not saying you need to be paranoid. If you destroyed some PPP records in good faith before August 2024 because you were following what you understood to be the rules at the time, your probably fine. The SBA’s August 2024 rule updating lender requirements specifically included a transition provision saying that records destroyed before that date in compliance with existing policies wouldn’t be subject to enforcement action. A similar principle would likely apply to borrowers who destroyed records in good faith compliance with the 6-year requirement.

The key phrase there is “good faith.” You had to actually beleive you were following the rules, not just claim you beleived it after the fact. And going forward, that defense becomes much harder to maintain now that the 10-year statute is well-publicized and the SBA has acknowledged it by updating lender requirements. Ignorance might have been a reasonable excuse in 2023, but its getting harder to claim in 2024 and beyond.

But going forward? Now that the fraud statute is clearly 10 years and the SBA has acknowledged this by updating lender requirements, destroying records after only 6 years becomes alot harder to justify as good faith compliance. You know—or should know—that the goverment has 10 years to investigate. Destroying evidence during that window is taking a significant risk.

And even if you avoid obstruction charges, consider the practical problem: without documentation, how do you prove your innocence? If an investigator asks how you calculated your payroll costs in 2020, and you can’t produce the records because you destroyed them, you’ve got nothing to show. If they ask to see bank statements proving you used the funds for eligible expenses, and those statements are gone, you can’t prove your case. The absence of records doesn’t prove you did anything wrong, but it makes it much harder to prove you didn’t.

The records you keep aren’t just for SBA compliance. Their for your own protection. Their your defense if someone ever questions what you did. And if you destroy them before the threat window closes, you’ve thrown away the evidence you’d need to defend yourself.

Complete Document Checklist: Everything You Need to Keep

So what exactly should you be holding onto for 10 years? Here’s a comprehensive list broken down by category.

Original Loan Application Documents

This is the foundation of your record-keeping. Everything you submitted when you applied for the loan needs to be preserved. These documents establish the baseline for your loan amount and demonstrate that your application was based on real numbers, not fabricated ones. If investigators ever question how you calculated your loan amount, these are the documents that tell your story.

• Your PPP loan application (whatever form you used)
• Payroll documentation you provided to support your loan amount—this includes tax forms like Form 941, Form 940, W-2s, W-3s, and any payroll reports
• Bank statements showing your payroll activity before the loan
• For self-employed individuals: Schedule C from your tax return
• Any worksheets or calculations you or your accountant used to determine your loan amount
• Documentation of your good faith certification that the loan was necessary
• Email correspondence with your lender during the application process
• Your lender’s approval documents

Forgiveness Application Documents

If you applied for and recieved forgiveness (which most borrowers did), keep everything related to that process. The forgiveness phase is where most PPP fraud allegations arise, because this is where borrowers had to certify how they actually used the funds. Your forgiveness documentation proves you spent the money on eligible expenses like payroll, rent, and utilities—not on personal purchases or ineligible business costs.

• Your forgiveness application (Form 3508, 3508EZ, or 3508S)
• All supporting documentation you submitted with the forgiveness application
• Bank statements showing how you used the PPP funds during the covered period
• Payroll records for the covered period proving you paid employees
• Receipts and documentation for eligible non-payroll expenses (rent, utilities, mortgage interest)
• FTE (full-time equivalent) calculations and supporting documentation
• Any worksheets used to calculate your forgivable amount
• Your lender’s forgiveness decision letter
• SBA forgiveness confirmation (if you recieved one)

Employment Records

Employment records are particularly important because payroll costs were supposed to make up at least 60% of your forgivable expenses. If you claimed employees or payroll amounts that didn’t actually exist, that’s fraud. If you legitimately had employees and paid them as required, your employment records prove it. Either way, these documents are central to any investigation.

• Employee headcount documentation before, during, and after the covered period
• Payroll registers showing payment dates and amounts
• W-4 forms and other employee tax documents
• Records of any salary reductions or layoffs
• Documentation of any employees who refused rehire offers
• Records showing restoration of FTE levels if applicable

Financial Records

Your financial records tell the complete story of how the money flowed—from when it came in to where it went out. Bank statements are the backbone of this category because they provide objective, third-party documentation of every transaction. These records can’t be faked retroactively (at least not without committing additional fraud), which makes them incredibly powerful evidence if you need to prove what happened.

• Bank statements from accounts where PPP funds were deposited
• Bank statements showing outgoing payments during covered period
• Cancelled checks or payment records for eligible expenses
• Lease or mortgage documents (if used for forgiveness)
• Utility bills and payment records (if used for forgiveness)
• Any loan agreements or other financing documents from that period

Communication Records

Communication records might seem like an afterthought, but they can be incredibly valuable in an investigation. Emails with your lender can show that you asked questions and tried to do things correctly. Communications with your accountant demonstrate that you relied on professional advice. If you ever have to explain why you made a particular decision, contemporanous communications from the time can support your story in ways that your memory alone never could.

• All correspondence with your lender about the PPP loan
• Any communications from the SBA
• Communications with your accountant or bookkeeper about PPP
• Any audit or verification requests and your responses
• Attorney correspondence (protected by privilege but still important to keep)
• Internal company emails discussing PPP decisions
• Text messages related to PPP decisions (if applicable)

This might seem like alot, but honestly most of this is stuff you should be keeping for tax purposes anyway. The key is making sure you can lay your hands on it if you ever need to prove what happened in 2020 or 2021.

One more thing about documentation: even if you didn’t keep perfect records at the time, don’t start trying to recreate them now. Creating documents after the fact to support your position is itself a crime—its called evidence tampering or fraud. If you have gaps in your records, the best approach is to gather what you do have and, if necessary, consult with an attorney about how to handle any deficiencies. Whatever you do, don’t try to paper over problems by fabricating documents.

How to Store Records Safely for 10 Years

Ten years is a long time to keep documents, especially paper documents that can be damaged, lost, or accidentally destroyed. Here’s how to make long-term retention practical and reliable.

Go Digital Whenever Possible

If you haven’t already, scan everything and create digital copies. Digital documents are easier to store, easier to search, and easier to back up. Most scanners can create PDF files, and most phones can take pictures that are good enough to serve as backup copies. The goal is to have at least one digital copy of every important document.

When you scan documents, make sure the quality is good enough to read all the text clearly. A fuzzy scan that you cant make out isnt much better then no scan at all. Take your time, make sure pages are straight, and verify that each scan is legible before moving on to the next one. This might take a few hours if you have alot of paper, but its time well spent considering whats at stake.

Create Multiple Backups

Don’t rely on a single storage location. Hard drives fail, computers get stolen, cloud services occasionally lose data. A good backup strategy includes:

• At least one local copy (external hard drive or computer)
• At least one cloud backup (Google Drive, Dropbox, iCloud, etc.)
• Ideally a third copy in a different physical location

The more copies you have in more places, the less likely you are to lose everything. Cloud storage is particularly good for long-term retention because it doesn’t depend on any particular device surviving for 10 years.

Think about what could go wrong over a decade. Your computer will probably be replaced at least twice. External hard drives can fail without warning. Even cloud services occasionally have problems—although major providers like Google, Microsoft, and Amazon have proven track records of data reliability. The point is that no single storage method is guaranteed to last 10 years, so redundancy is key.

Organize Logically

Create a clear folder structure so you can actually find documents when you need them. Something like:

PPP Loan Records /
├── Application /
├── Forgiveness /
├── Bank Statements /
├── Payroll Records /
├── Correspondence /
└── Miscellaneous /

Use descriptive file names with dates. “PPP_Application_April2020.pdf” is much better then “scan001.pdf” when your trying to find something 8 years later.

You might also consider creating a master index document—a simple spreadsheet or list that describes every file you’ve saved and where to find it. This makes it much easier to locate specific documents when you need them, and demonstrates that your organized and serious about compliance if anyone ever reviews your records.

Keep Some Paper Too

While digital is generally better for long-term storage, its not a bad idea to keep original paper documents for the most important items—especially anything with original signatures. Store them in a safe, dry location where they won’t be damaged by water, fire, or pests.

If your keeping paper documents, consider a fireproof safe or safety deposit box for the most critical items. Yes, this costs money and takes effort, but were talking about documents that could determine whether you face federal charges or walk free. The investment is worth the protection it provides.

When You Can Finally Destroy Records

So when can you actually get rid of all this stuff? The answer depends on your specific situation, but here’s the framework.

The fraud statute of limitations runs for 10 years from the date of the offense. For PPP fraud, the relevant date is generally whichever is later: when you recieved the loan, when you used the funds, or when your forgiveness was granted. Understanding this is important because most people think the clock starts when they got the loan, but for forgiveness-related fraud, it starts when you submitted false information in your forgiveness application—which might have been months or even a year after you recieved the loan.

If you got your loan in April 2020 and forgiveness was granted in September 2021, the statute runs from September 2021. Add 10 years and you get September 2031. That’s when the goverment loses its authority to prosecute you for that fraud.

To be safe, I’d recommend keeping records for at least 10 years from your forgiveness date, plus maybe an extra year or two as a buffer. So if your forgiveness was September 2021, plan to keep records untill at least September 2031, maybe untill 2032 or 2033 to be really safe.

Once that 10-year window closes and a reasonable buffer period has passed without any indication of investigation, you can finally shred those documents with confidence. The statute of limitations will have expired, and the goverment will have lost its ability to prosecute.

One caveat here: if your already under investigation, the statute of limitations becomes less relevant. Once an investigation is underway, you absolutely should not destroy any documents regardless of how old they are. And if you’ve been charged with a crime, destroying documents becomes obstruction of justice. The 10-year guideline assumes you haven’t recieved any indication that you’re being investigated—no subpoenas, no FBI visits, no letters from federal prosecutors.

Heres a practical tip for determining your end date. Find these three dates for your PPP loan:

• Date you recieved the loan funds
• Date you submitted your forgiveness application
• Date your forgiveness was approved

The statute of limitations likely runs from the latest of these dates. Add 10 years to that date, then add another year for safety. That’s when you can finally, confidently dispose of your PPP records.

Untill then? Keep everything. Store it safely. Back it up. You never know when you might need to prove what really happened back in 2020.

Protect Yourself: Keep Records for 10 Years

The official SBA requirement says 6 years. But the reality of federal enforcement says 10 years. And when theirs a conflict between minimum compliance and actual self-protection, you should always err on the side of protecting yourself.

Lets recap what we’ve covered in this article. The SBA’s 6-year borrower record retention requirement was established before Congress extended the fraud statute of limitations to 10 years. The SBA has since updated the lender requirement to 10 years, acknowledging this is the appropriate timeline given current law. But the borrower requirement hasn’t been formally updated, creating a dangerous gap where borrowers might think its safe to destroy records after 6 years when the goverment can still prosecute them for another 4 years.

Keep your PPP loan records for 10 years from your forgiveness date (or loan date if no forgiveness). Don’t destroy anything just because 6 years have passed. Destroying records too early could leave you defenseless if an investigation comes later, and could potentially result in additional obstruction charges.

The SBA Office of Inspector General and the DOJ COVID-19 Fraud Enforcement Task Force are still actively investigating PPP fraud, and they’ll continue doing so for years to come. These agencies have made clear that pandemic fraud enforcement remains a top priority, and their prosecuting cases big and small. The fact that years have passed since you got your loan doesn’t mean your in the clear—it just means they haven’t gotten to you yet.

Give yourself the protection of comprehensive records. The peace of mind is worth the storage space. Keeping good records isn’t an admission that you did anything wrong—its just smart business practice that protects you if questions ever arise.

And if you have questions about your specific situation—weather you need to keep certain documents, how long your specific statute runs, or what to do if you’ve already destroyed some records—talk to a federal defense attorney. They can review your situation and give you guidance tailored to your circumstances. Its a small investment for significant peace of mind. Don’t wait untill theres an investigation to get advice—by then it may be too late to fix problems with your documentation.