How to Handle an SBA Subpoena for PPP Loan Records

How to Handle an SBA Subpoena for PPP Loan Records

Immediate Response to the Subpoena

The subpoena is not the beginning of the investigation. It is, in most cases we have encountered, confirmation that the inquiry has been underway for months, conducted under Rule 6(e) of the Federal Rules of Criminal Procedure, using records your bank produced without informing you. The envelope in your hand means the Department of Justice or the SBA Office of Inspector General has already assembled a considerable portion of its case. What you do in the first days after receiving that document will shape the trajectory of everything that follows.

Retain counsel with specific experience in federal white collar defense. Not a general practitioner. Not the attorney who incorporated your LLC. A lawyer who understands subpoena compliance, the distinction between a target and a witness, and the narrow circumstances under which negotiation with the government can alter an outcome. Once counsel is engaged, issue an internal document preservation directive covering every email, bank statement, payroll record, draft of the PPP application, and communication with your lender or accountant. All of it is now evidence. Destroying any of it, even through routine file management, constitutes a separate federal offense.

The third requirement is silence. Do not discuss the substance of the subpoena with federal agents, with your bank, with your accountant, or with former employees until counsel has reviewed the instrument and advised you on its scope. Investigators are skilled at interpreting voluntary cooperation as an invitation to broaden the inquiry, and anything communicated outside the privilege is potentially discoverable.

The Statute of Limitations

In August 2022, Congress extended the statute of limitations for PPP fraud from five years to ten. The PPP and Bank Fraud Enforcement Harmonization Act, passed with bipartisan support, provides that any criminal charge or civil enforcement action alleging borrower fraud may be filed within ten years of the offense. The operative phrase, “notwithstanding any other provision of law,” overrides shorter limitations periods that might otherwise apply under wire fraud or bank fraud statutes.

The ten-year clock runs from the date of the offense. For most borrowers, that date is the submission of the PPP application, placing the outer boundary in 2030 for first-round loans. But the calculation is not always that clean. A borrower who submitted a forgiveness application containing false certifications committed a separate offense under 18 U.S.C. § 1001, and the clock for that offense runs from the date of submission, which may have been 2021 or 2022. Multiple potential offenses produce multiple limitations periods operating simultaneously. The latest of them controls your exposure.

In August 2024, the SBA published an interim final rule extending its lender records retention requirement to ten years from the date of disposition of each PPP loan. Borrowers, however, were technically required to retain records for only six years. The four-year gap between the borrower’s retention obligation and the government’s prosecution window is worth considering. A borrower who shreds files after six years, believing the obligation complete, may find the government prosecuting with the lender’s copies of those same records. The mismatch is structural, and it is not in the borrower’s favor.

One receives the subpoena and discovers, often for the first time, that forgiveness was not closure. It was the opening of a file the government never intended to close.

Grand Jury and Administrative Subpoenas

The instrument matters. A grand jury subpoena, issued under Federal Rule of Criminal Procedure 17, signals a criminal investigation. An administrative subpoena or Civil Investigative Demand from the SBA operates under a different statutory framework and may indicate that the matter remains at the civil stage, though the comfort in that distinction is limited.

Grand jury proceedings occur behind closed doors. Your attorney cannot enter the room. The threshold for issuing the subpoena is low; the government need not establish probable cause. An administrative subpoena, by contrast, may be challenged on broader grounds, including relevance and overbreadth. But in the PPP context, where the SBA’s Office of Inspector General has indicated that a substantial share of criminal referrals originate from what began as routine forgiveness reviews, the line between civil inquiry and criminal exposure can dissolve without ceremony.

Both instruments compel production. Both carry penalties for noncompliance. The practical difference is one of degree.

What the Government Already Possesses

Before the subpoena reached you, the DOJ had already issued grand jury subpoenas to JPMorgan Chase, Bank of America, Wells Fargo, and other major PPP lenders. Those institutions complied, as they were legally required to do. They were not required to notify you. Your banking history, from the lender’s perspective, was already in federal hands: deposits, transfers, withdrawals, and the full record of how PPP funds moved through your accounts.

The government also possesses your IRS records. The cross-referencing of PPP applications against tax filings is (and this is a point worth dwelling on, because many borrowers still do not grasp it) not a recent initiative but a method the Pandemic Analytics Center of Excellence has employed since the program’s earliest months. A business that claimed a certain payroll figure on its application but reported a materially different figure on quarterly tax filings generated a flag that required no human judgment to produce. The discrepancy did not require a whistleblower. It required a query.

Whistleblowers, however, have become a separate and potent source. The False Claims Act’s qui tam provisions permit private citizens to file lawsuits on the government’s behalf, and those citizens receive a share of any recovery. A category of plaintiff that barely existed before this program, the data mining relator, has constructed analyses of increasing sophistication using the PPP loan data the SBA itself published. Corporate ownership records, employment databases, loan amounts: all of it is accessible to anyone with sufficient motivation to examine it. In early 2026, the Southern District of New York resolved a case against a fashion company that allegedly misrepresented its eligibility for a second-draw loan. The investigation relied, in part, on precisely this kind of publicly available information.

The SBA’s forgiveness process is itself an investigative instrument. The agency has stated that it may review any PPP loan at any time, in its discretion. Forgiveness, which borrowers understood as the conclusion of the government’s interest, functions as the opposite. In one documented case, a borrower in Kansas City whose loans were forgiven in 2021 received a sentence of fifty-one months of imprisonment in 2025 for the fraud underlying those same loans. Four years passed between forgiveness and sentencing. The government was not idle during any of them.

What this means, practically, is that the subpoena addressed to you is not a request to begin assembling the government’s case. The investigation commenced before you received notice, proceeded through your bank’s records, your tax filings, and possibly the testimony of individuals in your professional circle, and arrived at the stage where your own records or testimony would resolve whatever questions remained. Whether every investigation follows this sequence with the precision described here is a question I cannot answer from the cases available to me. The enforcement apparatus is large and not uniform. Some cases begin with Suspicious Activity Reports filed by banks under the Bank Secrecy Act. Others originate from inspector general audits, or from the sheer improbability of a loan application that survived initial review but could not survive scrutiny. The path to the subpoena varies. What awaits at the other end tends not to.

Document Production and the Fifth Amendment

The most common error among recipients of PPP subpoenas concerns the Fifth Amendment. The privilege protects testimony. It does not protect documents. For a subpoena duces tecum, the constitutional right against self-incrimination does not extend to the contents of the records demanded. Your PPP application, your payroll records, your bank statements: these are not testimonial, and the government may compel their production regardless of what they reveal.

The Fifth Amendment becomes relevant if you are called to testify before the grand jury. In that setting, you may decline to answer questions where a truthful response could incriminate you. You may not refuse to appear. Your attorney waits outside; counsel is not permitted in the grand jury room, though most courts recognize the right to step out and consult before answering a given question.

A narrow exception exists. The act of producing documents can carry testimonial significance, because production implicitly authenticates the records and confirms their existence and your possession of them. In limited circumstances, this “act of production” doctrine may support a Fifth Amendment objection. The doctrine is narrowly applied, and in the PPP context, where the government typically possesses copies of the relevant documents from third-party sources already, the argument is difficult to advance. Counsel can evaluate whether the doctrine applies to your circumstances, but one should not rely on it as a shield.

Civil and Criminal Enforcement

The government pursues PPP fraud on two tracks. Criminal prosecution carries penalties including imprisonment, fines, and forfeiture. Civil enforcement under the False Claims Act carries treble damages and per-claim penalties that accumulate with each false statement submitted. The civil standard of proof, a preponderance of the evidence, is lower than the criminal standard. The DOJ reported that False Claims Act recoveries reached a record level in fiscal year 2025, with whistleblowers filing close to 1,300 qui tam actions in that year alone.

The qui tam provisions have produced something resembling a private enforcement industry. A former employee, a former partner, an accountant who prepared the application: any of these individuals can initiate a suit and participate in the recovery. The reconciliation clause in these arrangements functions the way a smoke detector functions in a building already condemned: technically present, operationally irrelevant to the outcome. The financial incentive to report is substantial, and the government’s willingness to intervene in meritorious cases remains high.

I should note that the current administration’s posture toward pandemic fraud enforcement has been characterized differently by different observers, and I am less certain about the direction of enforcement policy than I am about the statutory framework that sustains it. What is clear is that the ten-year limitations period, the qui tam incentive structure, and the volume of publicly available data will sustain enforcement activity regardless of shifts in prosecutorial appetite.

What Follows

The subpoena arrives, typically, on an ordinary afternoon. It does not announce itself. It sits in a stack of mail or appears in a process server’s hand, and for a moment it resembles every other piece of legal correspondence a business owner receives and sets aside. That moment passes.

For the business owner holding a subpoena for PPP loan records, what follows is a series of decisions that must be made with competent guidance and without delay. The records must be preserved. The scope must be assessed. The nature of the inquiry, whether civil, criminal, or both, must be determined with precision, because the response to each differs in ways that matter. A consultation with experienced federal defense counsel is the first and most consequential step, and it is one that costs nothing to initiate and assumes nothing about the outcome. The government has been assembling its position for months. Your preparation should begin the day the envelope is opened.

The broader principle is not particular to PPP loans. It applies to every federal program where the application process required a certification, the certification carried criminal penalties for misrepresentation, and the government retained the authority to revisit its own approvals years after the fact. The PPP is one instance of a pattern that will recur, in different forms, for as long as the government distributes emergency funds under conditions that reward speed over verification.