Blog
PPP Loan Fraud Investigations: What You Need to Know
The Statute That Moved
The window for federal prosecution of PPP loan fraud is not closing. In August 2022, Congress extended the statute of limitations from five years to ten through the PPP and Bank Fraud Enforcement Harmonization Act. The extension applied to conduct that had already occurred. A loan originated in April 2020 is now prosecutable until 2030. A forgiveness application submitted in 2021 carries its own separate clock. The earliest PPP borrowers discovered that Congress had altered the finish line without announcement.
What this means in practice is less comfortable than the statute itself. The Department of Justice reported that False Claims Act recoveries in fiscal year 2025 exceeded the highest annual total in the statute’s history. Whistleblowers filed over a thousand new qui tam actions in that fiscal year alone, many of them targeting PPP recipients. The enforcement apparatus is not winding down. It is, if we are being precise, still accelerating.
The early prosecutions were simple: individuals who fabricated businesses entirely, who purchased luxury vehicles with loan proceeds, who submitted applications for companies that existed only as a name on a filing. Those cases were low fruit, and most of them resulted in guilty pleas. The current phase targets legitimate businesses that may have been ineligible for the loans they received, or that certified compliance with requirements they did not satisfy. The distinction between fraud and error, in this area of law, is narrower than most business owners assume.
Eligibility, Not Embezzlement
The SBA’s affiliation rules are where many otherwise honest businesses find themselves exposed. A company with five hundred employees that certified it met the size standard, without accounting for affiliated entities under common ownership, submitted a false certification. Whether the owner understood the affiliation rules at the time is a question of fact that the government is not obligated to resolve in the business owner’s favor.
Second-draw loans present a separate category of risk. To qualify for a second draw, a business needed to show a twenty-five percent reduction in gross receipts in at least one quarter of 2020 compared to the corresponding quarter of 2019. The SBA’s guidance on how to calculate that reduction changed during the program. A business that relied on early guidance may have certified a reduction that later interpretations would not support. The certification was made under penalty of perjury.
One does not need to have acted with criminal intent to face civil liability under the False Claims Act. There are exceptions to this pattern, though in practice they tend to confirm the rule. The statute reaches conduct that is reckless, and recklessness, in this context, includes failing to investigate what one had reason to suspect.
The False Claims Act and the Rise of Data Relators
The criminal prosecutions receive the attention. The civil enforcement, conducted under the False Claims Act, is where the volume resides.
Under the FCA, private individuals known as relators can file qui tam lawsuits on the government’s behalf. If the government intervenes and recovers funds, the relator receives a percentage of the recovery: between fifteen and thirty percent of whatever is collected. The incentive structure is considerable. In fiscal year 2025, more new qui tam actions were filed than in any previous year on record.
What distinguishes the current wave of PPP qui tam cases is the source. Traditional whistleblowers are insiders: employees, partners, accountants who witnessed the conduct firsthand. PPP data, however, is publicly available. The SBA released loan data that includes the borrower’s name, the loan amount, the lender, and the number of jobs the borrower reported. That data set has attracted a new category of relator: the data miner.
Data relators employ algorithmic tools, and increasingly artificial intelligence, to scan public loan data for anomalies: a sole proprietorship that received a loan implying fifty employees, a business that received both first and second draw loans totaling more than its reported annual revenue, a company that certified fewer than five hundred employees but is (through affiliated entities that the relator can identify using state corporate filings, shared addresses, and overlapping officers) part of a family of companies that employs several thousand. The relator need never have heard of the business before filing the complaint.
The Kabbage settlement in 2024 illustrated the scale of lender exposure. The bankrupt fintech lender agreed to resolve False Claims Act allegations for a sum that reflected not only borrower fraud but the lender’s own failure to implement adequate controls. Kabbage processed loans for over three hundred thousand borrowers. The DOJ alleged that the company removed underwriting steps to process more applications, set weak fraud thresholds despite the SBA’s warnings, and discouraged its own staff from questioning suspicious applications. An internal message from a manager stated that the risk belonged to the SBA, not to the lender. That sentence, preserved in a Slack channel, became the government’s exhibit.
Whether the current administration will sustain the same enforcement tempo is a question the data does not yet answer. The FCA recoveries suggest momentum. The qui tam filing rate suggests that private relators, at minimum, show no indication of relenting.
What the SBA Reviews
The SBA’s Office of Inspector General has flagged tens of thousands of loans for potential review. Not every flagged loan becomes an investigation. But the criteria that draw attention are worth understanding, and they are not limited to obvious misconduct.
Loans above certain thresholds receive automatic scrutiny. Second-draw loans, because they require the gross receipts certification, generate documentation that can be compared against tax filings the IRS already possesses. Discrepancies between the loan application and the borrower’s IRS records are the most common trigger we encounter. A business that reported a certain payroll figure on its PPP application but a different figure on its quarterly Form 941 has created a discrepancy that the government views as requiring explanation.
The forgiveness application is its own event. When a borrower certifies that loan proceeds were used for eligible expenses, that certification constitutes a separate statement to the government. We have seen cases where the loan was defensible but the forgiveness application was not, because the borrower lacked documentation to support the percentages it certified.
The government may review a borrower’s file for months before the borrower receives a subpoena or civil investigative demand. By the time the letter arrives, the government has already formed a preliminary view.
The Forgiveness Application
For many businesses, the forgiveness application is the more dangerous document. The loan application required certifications about eligibility and payroll. The forgiveness application required certifications about how the money was spent: what percentage went to payroll, what percentage to rent, utilities, and other covered expenses. These percentages determined whether the loan was forgiven in full, in part, or not at all.
The problem is granular. A business that included an owner’s compensation above the program cap. A business that counted expenses outside the covered period. A business that certified sixty percent payroll expenditure when the actual figure, reconstructed from bank statements, was closer to fifty-five. These are not the cases that produce prison sentences. They are the cases that produce FCA liability at treble damages.
In something like forty percent of the forgiveness-related inquiries we review, the underlying issue is not fraud but documentation. The business spent the money in accordance with program requirements but cannot demonstrate it to the government’s satisfaction, because records were not maintained with the anticipation that they would be examined six years later. The SBA requires borrowers to retain all loan documentation. The practical reality is that many businesses treated forgiveness as the end of the process.
Responding to a Subpoena or Civil Investigative Demand
A subpoena or civil investigative demand related to a PPP loan is not a charge. It is a request for information, though one that carries consequences for noncompliance. The appropriate response depends on whether the inquiry is criminal or civil, a distinction that is not always apparent from the document itself.
The first step is preservation. When a business receives a government inquiry, all documents related to the PPP loan, the payroll records, the bank statements showing use of proceeds, and communications about the loan must be preserved. Destruction of documents after receipt of a subpoena is a separate federal offense.
- Identify and preserve all documents related to the loan application, forgiveness application, and use of proceeds.
- Engage counsel before responding to the government or communicating about the inquiry.
- Reconstruct the timeline: application date, disbursement, expenditure of funds, forgiveness submission.
We approach the initial response to a PPP inquiry in a manner that differs from standard practice. The conventional recommendation is to produce documents and wait. Our experience is that a narrative explanation, prepared with care and submitted alongside the document production, can shape the government’s assessment before the investigation acquires momentum. The government is reviewing hundreds of these matters. A coherent account, supported by contemporaneous records and presented at the outset, can be the difference between a matter that closes with a letter and one that proceeds to litigation. The qualification is real: this approach works when the underlying facts support it, and we do not recommend it when they do not.
The cost of responding is not trivial. For a business of moderate size, the legal fees and internal resources required to collect, review, and produce documents can reach into six figures even when the matter resolves favorably. This is the expense that business owners do not anticipate until the envelope arrives on a Friday afternoon.
A Longer View
PPP enforcement will continue for the remainder of this decade. The statute of limitations does not expire for most loans until 2030 or 2031. Civil exposure through the False Claims Act may extend further depending on when the government or a relator files suit.
The pattern of pandemic fraud enforcement follows the pattern of every large federal disbursement: the initial years produce the obvious prosecutions, the middle years produce the eligibility disputes, and the final years produce the cases that test the outer boundaries of what the statute was designed to reach. We are in the middle years now.
A consultation is where this conversation begins. There is no cost for the initial call, and no assumption that representation will follow. It is the beginning of a diagnosis, which is what the situation requires before it permits anything else.