Criminal Defense Lawyers

PPP Fraud Statute of Limitations: What Changed in 2022?

PPP Fraud Statute of Limitations: What Changed in 2022?

In August 2022, Congress doubled the time federal prosecutors have to charge you with PPP fraud. If you got a PPP loan in 2020 and thought the goverment would have to charge you by 2025 or 2026, you were wrong. Under the new law, prosecutors have untill 2030 to bring charges—and that extra time changes everything for borrowers who made mistakes on their applications.

The change happened without much fanfare. Two bills passed Congress with bipartisan support, President Biden signed them into law, and suddenly millions of PPP borrowers faced a much longer window of potential prosecution. Most people never heard about it. Many still don’t know the rules changed. But if your wondering how long you need to worry about that loan you got during the pandemic, the answer is now a full decade from when you recieved it.

This article explains exactly what changed in 2022, why Congress extended the statute of limitations, and what the new 10-year timeline means for your specific situation. If you’ve been operating under the assumption that your exposure was limited to 5 or 6 years, you need to update your understanding—because the goverment just bought itself alot more time to investigate.

I’ve encountered many business owners who were shocked to learn about the 2022 change. They had been counting down to their 5-year anniversary, planning to finally breathe easy once that date passed. Then they discovered the rules had changed, and their relief evaporated. If your in that situation, I understand how frustrating it is. But its better to know the truth now then to discover it when investigators come calling.

The Old Rules: What the Statute of Limitations Used to Be

Before August 2022, the statute of limitations for PPP fraud depended on what charges prosecutors chose to bring. This created a confusing patchwork of different timelines based on technicalities most borrowers knew nothing about.

If prosecutors charged you with wire fraud under 18 U.S.C. 1343, the statute of limitations was 5 years. Wire fraud is basically any fraud scheme that uses electronic communications—emails, wire transfers, phone calls, internet transmissions. Since PPP applications were submitted electronically and funds were transferred electronically, wire fraud was a natural charge for prosecutors to use.

But if prosecutors charged you with bank fraud under 18 U.S.C. 1344, the statute of limitations was 10 years. Bank fraud involves schemes to defraud a financial institution or obtain money from a bank through false pretenses. Since traditional banks issued many PPP loans, prosecutors could sometimes use bank fraud charges and get the longer 10-year window.

Here’s where it got complicated. Not all PPP loans came from traditional banks. Many borrowers got their loans through fintech companies, online lenders, and other non-bank financial institutions. These lenders weren’t “financial institutions” under the bank fraud statute, which meant prosecutors couldn’t use bank fraud charges for those loans. They were stuck with wire fraud and its shorter 5-year limit.

This created an arbitrary distinction. Two borrowers who commited identical fraud—same false statements, same misuse of funds—could face completley different timelines depending on whether they got their loan from Bank of America or from an online fintech lender. The borrower who used a traditional bank could be charged for 10 years. The borrower who used a fintech had only 5 years of exposure. Same crime, different consequences, based entirely on the accident of which lender they chose.

By early 2022, investigators were realizing this was a serious problem. The scale of PPP fraud was massive—far bigger then anyone anticipated when the program launched in 2020. The goverment had already charged over 1,000 defendants with alleged losses exceeding $1.1 billion, and they’d barely scratched the surface. Tens of thousands of potentially fraudulent loans had been flagged but not yet investigated. And for loans issued through fintechs, the 5-year clock was already ticking toward expiration.

If nothing changed, prosecutors would have had to either rush investigations or let potential fraudsters escape accountability simply because time ran out. That’s not how the goverment wanted this to end.

There was also a resource problem. Federal investigators—FBI agents, SBA inspectors, DOJ prosecutors—can only handle so many cases at once. The sheer volume of potentially fraudulent PPP loans meant that many cases simply couldn’t be investigated within the original timeframe. It wasnt that investigators didn’t care or weren’t working hard. They were completley overwhelmed by the scale of the fraud. The 5-year statute meant some cases would inevitably slip through the cracks, and Congress wasn’t willing to accept that outcome.

The August 2022 Change: What Congress Actually Did

On August 5, 2022, President Biden signed two bills that fundamentally changed the landscape for PPP and EIDL fraud enforcement. The legislation had passed Congress with bipartisan support—a rare achievement in our politically divided era, and a sign of how seriously legislators took pandemic fraud.

The first bill was H.R. 7352, the PPP and Bank Fraud Enforcement Harmonization Act of 2022. Despite its bureaucratic name, this bill did something very simple: it established a 10-year statute of limitations for any criminal charge or civil enforcement action alleging that a borrower engaged in fraud with respect to a PPP loan. Regardless of what specific charge prosecutors used, regardless of whether the loan came from a bank or a fintech, the limit was now 10 years across the board.

The second bill was H.R. 7334, the COVID-19 EIDL Fraud Statute of Limitations Act of 2022. This did the same thing for Economic Injury Disaster Loans that H.R. 7352 did for PPP loans—establishing a uniform 10-year statute for all EIDL fraud.

The key language from H.R. 7352 is worth understanding. The bill amended Section 7(a) of the Small Business Act to provide that “notwithstanding any other provision of law, any criminal charge or civil enforcement action alleging that a borrower engaged in fraud with respect to a covered loan shall be filed not later than 10 years after the offense was committed.”

That phrase “notwithstanding any other provision of law” is critical. It means the 10-year limit overrides any shorter statute that might otherwise apply. Wire fraud’s 5-year limit? Overridden. Any other criminal statute with a shorter limit? Overridden. The 10-year PPP-specific statute now controls.

The legislation also clarified that this 10-year period applies to both criminal charges AND civil enforcement actions. This is important because the goverment can pursue fraud through either track. Criminal prosecution means potential prison time. Civil enforcement under the False Claims Act means treble damages and penalties. Under the new law, both options remain available for a full decade.

Its worth emphasizing just how significant this change was. Before August 2022, a borrower who got a PPP loan from a fintech in April 2020 would have seen their exposure expire in April 2025—less then five years away. After the change, that same borrower’s exposure extends untill April 2030—over eight years away at the time the law passed. That’s not a minor adjustment. It fundamentally changed the calculus for everyone involved.

The change also affected how prosecutors could approach complex cases. Some PPP fraud schemes involved multiple participants, shell companies, and elaborate cover-ups that take years to unravel. Under the old 5-year statute, prosecutors might have been forced to bring charges before their investigation was complete, potentially missing co-conspirators or additional crimes. With 10 years, they can take the time needed to build comprehensive cases that capture the full scope of criminal activity.

The bills passed with overwhelming bipartisan support. According to the Journal of Accountancy, there was broad agreement that pandemic fraud watchdogs needed more time to pursue what had become one of the largest fraud schemes in American history. Legislators on both sides of the aisle wanted to ensure that fraudsters couldn’t escape accountability just because investigators were overwhelmed by the sheer volume of suspicious loans.

Why Congress Extended the Statute: The Harmonization Problem

Understanding why Congress made this change helps you understand the goverment’s priorities and why they consider PPP fraud enforcement so important.

The primary rationale was harmonization—making sure all PPP fraud cases were treated equally regardless of which type of lender issued the loan. The arbitrary distinction between bank and non-bank lenders made no sense from a policy perspective. Two people who commited the same fraud shouldn’t face different timelines based on where they happened to apply for their loan.

The House Report accompanying H.R. 7352 explained this reasoning. The report noted that bank fraud already had a 10-year statute because defrauding banks was considered a serious offense warranting extended investigation time. But PPP loans issued by non-banks involved the same goverment-guaranteed money and the same false certifications—the only difference was the middleman processing the application. Treating those loans differently made no logical sense.

The second rationale was practical necessity. The scale of PPP fraud was unprecedented. The goverment distributed nearly $800 billion through the program, and estimates suggested that a significant percentage involved some level of fraud—ranging from minor miscalculations to outright criminal schemes involving fake businesses and stolen identities. Investigating that volume of potential fraud takes time—far more time then the original 5-year statute allowed.

Consider what investigators were facing. By March 2022, before the extension passed, the goverment had already charged over 1,000 defendants. But they had flagged tens of thousands of additional potentially fraudulent loans totalling billions more dollars. Each investigation takes time. Complex fraud schemes involving multiple participants, shell companies, and layered transactions can take years to unravel. A 5-year statute meant many of these cases would expire before investigators could even get to them.

The third rationale was deterance. By extending the statute to 10 years, Congress sent a clear message: if you commited PPP fraud, you can’t just wait out the clock. The goverment will have time to find you, investigate you, and prosecute you. This message was directed both at people who had already commited fraud and at anyone thinking about making false claims on future goverment programs.

Supporters of the legislation also pointed out that 10 years was already the standard for bank fraud—one of the most serious white collar crimes. Given that PPP fraud involved taxpayer money and abuse of emergency pandemic relief, treating it with the same seriousness as bank fraud seemed appropriate. If anything, some argued, PPP fraud deserved even harsher treatment because it exploited a national crisis.

The political messaging around the legislation was interesting too. Both parties wanted to be seen as tough on pandemic fraud. Republicans could point to it as evidence of fiscal responsibility and protecting taxpayer money. Democrats could point to it as protecting programs meant to help legitimate small businesses. Nobody wanted to be on record voting against tools to prosecute people who stole emergency relief funds during a pandemic. The result was overwhelming bipartisan support that got the bills through Congress quickly.

For borrowers, the message from Congress was clear: we’re taking this seriously, and we’re giving prosecutors all the time they need to find and punish fraudsters. The days of hoping to run out the clock are over.

What This Means For Your PPP Loan

So what does the 2022 change mean for you specifically? If you got a PPP loan in 2020 or 2021, here’s how to calculate your exposure timeline.

The statute of limitations runs for 10 years from the date of the offense. For PPP fraud, the relevant date is generally when the fraudulent statement was made—which is typically whichever is later: when you submitted your loan application with false information, or when you submitted your forgiveness application with false information.

Lets do the math with some common scenarios:

Scenario 1: You got a PPP loan in April 2020 and recieved forgiveness in 2021. If your loan application contained false statements, the clock started in April 2020. Prosecutors have untill April 2030 to charge you. If your forgiveness application also contained false statements, they have untill whenever that was submitted plus 10 years.

Scenario 2: You got a PPP loan from the second draw in early 2021 and recieved forgiveness later that year. Your application clock started in early 2021. Prosecutors have untill early 2031 to bring charges.

Scenario 3: You got a PPP loan in 2020 and never applied for forgiveness (you repaid it or its still outstanding). Your exposure is limited to false statements on the original application, and prosecutors have untill 2030.

Scenario 4: You got both a first-draw and second-draw PPP loan. Each loan has its own 10-year clock running from when you applied. If there was fraud on both applications, prosecutors can potentially bring charges for both, and the statute for the second-draw loan extends further into the future. Someone with a first-draw loan from April 2020 and a second-draw loan from March 2021 would have exposure extending untill March 2031.

The key takeaway is that nobody is “out of the woods” yet. Even the earliest PPP loans from April 2020 have a statute that doesn’t expire untill April 2030. If you thought you were close to the finish line, the 2022 change moved that finish line back significantly.

From a practical standpoint, this means you should keep all records related to your PPP loan for at least 10 years. The Nixon Peabody analysis of the new law specifically recommends that borrowers “maintain all of their loan files for at least 10 years from the date a loan was received, used, and—if applicable—forgiven.” This includes your application, supporting documentation, bank statements showing fund usage, payroll records, and forgiveness documents.

If you destroy records before the 10-year window closes and then get investigated, you’ll have no documentation to support your defense—and potentially face obstruction charges on top of whatever fraud charges might be coming.

Another practical consideration is the psychological burden. Before August 2022, some borrowers were counting down to their 5-year anniversary, thinking they’d soon be free of any potential liability. The 2022 change reset that clock dramatically. If you were expecting closure in 2025, you now have to wait untill 2030. That’s five more years of uncertainty, five more years of keeping records, five more years of wondering if investigators might come knocking. Its a significant change in how long you need to manage this concern.

Some people ask weather they should proactively contact authorities if they realize they made errors on their application. This is a complicated question that depends on your specific circumstances, and its definitly something to discuss with an attorney before taking action. In some cases, voluntary disclosure can help your position. In other cases, it can make things worse. Don’t make that decision without professional guidance.

The Retroactivity Question: Does This Apply to Loans Already Taken?

One question that comes up frequently is whether the 2022 change applies to loans that were already issued before the law passed. The short answer is yes—the new 10-year statute applies to all PPP loans, including those issued in 2020 and early 2021.

This might seem unfair. If you commited fraud in 2020 expecting a 5-year statute, and Congress changed the rules in 2022, isn’t that changing the rules after the fact? Legally speaking, the answer is nuanced but ultimately favorable to the goverment.

Generally, extending a statute of limitations doesn’t raise the same constitutional concerns as other retroactive laws. The prohibition against “ex post facto” laws primarily prevents the goverment from criminalizing conduct that was legal when it occurred, or from increasing punishments retroactively. Extending the time to prosecute existing crimes is treated differently—its not making new conduct criminal or increasing the punishment, just giving prosecutors more time to bring existing charges.

Courts have consistently upheld extensions of statutes of limitations as long as the original statute hasn’t already expired. Since the 5-year wire fraud statute for 2020 loans wouldn’t have expired untill 2025, and Congress passed the extension in 2022, the new 10-year period applied to those loans. If Congress had waited untill 2026 to extend the statute, it would have been too late for some 2020 loans—but they didn’t wait.

The practical effect is that everyone with a PPP loan is operating under the same 10-year rule, regardless of when they got their loan or what they expected when they applied. The goverment now has untill at least 2030 to investigate the earliest PPP loans, and untill 2031 or later for loans from the second draw.

If your planning around the assumption that your exposure ends in 2025 or 2026, you need to update those plans. The 2022 law changed everything.

One thing worth noting is that the retroactive application of the statute extension has not been seriously challenged in court. While defendants have raised various constitutional arguments in PPP fraud cases, the statute of limitations extension itself has been generally accepted as valid. Courts have historically been permissive about allowing Congress to extend limitations periods for pending cases, and there’s no indication that this will change for PPP fraud prosecutions.

From a practical standpoint, this means you shouldn’t count on any legal challenge to the extension succeeding. Assume the 10-year statute applies to your loan, because it almost certainly does. Planning based on any other assumption would be risky and potentially harmful to your interests.

The Bottom Line: 10 Years Is the New Reality

The statute of limitations changes that took effect in August 2022 fundamentally altered the enforcement landscape for PPP and EIDL fraud. What was once a 5-year window for many cases is now a uniform 10-year period for all cases, regardless of lender type or specific charges.

If you got a PPP loan in 2020, prosecutors have untill 2030 to charge you. If you got a second-draw loan in 2021, they have untill 2031. These deadlines apply to both criminal prosecution and civil enforcement under the False Claims Act. Forgiveness doesn’t change the timeline—the goverment can investigate and charge you for fraud on a forgiven loan just as easily as an unforgiven one.

The bipartisan passage of these bills tells you something important about goverment priorities. Legislators on both sides of the aisle agreed that PPP fraud enforcement deserved the same serious treatment as bank fraud. They didn’t want fraudsters escaping accountability because investigators were overwhelmed by the volume of suspicious loans.

What should you do with this information? First, keep all your PPP records for at least 10 years from your forgiveness date. Second, understand that your exposure window is longer then you might have thought. Third, if you have concerns about your loan—weather you made errors on your application, weather your spending was compliant, or weather you might be a target of investigation—consult with a federal criminal defense attorney who can assess your specific situation.

The 2022 change happened relatively quietly, but its impact is enormous. If you didn’t know the rules had changed, now you do. The goverment has 10 years to investigate PPP fraud, and their not done investigating yet.

Looking ahead, the extended statute means PPP fraud enforcement will continue well into the next decade. The SBA Office of Inspector General and the DOJ COVID-19 Fraud Enforcement Task Force have both indicated that pandemic fraud remains a top priority. They’ve built sophisticated data analytics capabilities to identify suspicious loans, and their systematically working through the backlog of flagged applications. The 10-year statute gives them the runway they need to complete that work.

For borrowers who did everything right, the extended statute is merely an inconvienence—you’ll need to keep records longer and live with uncertainty longer, but you don’t have anything to worry about. For borrowers who made innocent mistakes, the extended statute means more time to potentially be audited, but honest errors don’t typically result in criminal prosecution. But for borrowers who commited deliberate fraud, the 2022 change eliminated what might have been their best escape route. Running out the clock is no longer an option.

The bottom line is simple: the rules changed in 2022, and they changed significantly. Whatever timeline you had in your head before August 2022, update it. The goverment now has 10 years to investigate and prosecute PPP fraud, and their using every day of that time to pursue cases. If you have concerns about your loan, address them proactively rather then hoping the statute will save you—because it won’t expire for years to come.