Blog
Received a Civil Investigative Demand (CID) for My EIDL Loan: Now What?
Received a Civil Investigative Demand for My EIDL Loan: Now What?
The Government Already Has a Theory
A Civil Investigative Demand does not arrive because someone at the Department of Justice is curious. It arrives because a theory has been constructed, evidence has been gathered to support that theory, and what remains is confirmation. The envelope in your hand is not the beginning of the investigation into your Economic Injury Disaster Loan. It is closer to the middle.
Most borrowers who contact our office after receiving a CID operate under the assumption that they have been selected for routine review. They use the word “audit.” The document itself, if one reads it with care, dispels that assumption within the first paragraph: it will reference a specific provision of the False Claims Act, cite 31 U.S.C. § 3733 as its statutory authority, and identify the nature of the conduct under investigation. The statute permits the government to issue a CID only when it has reason to believe a person possesses information relevant to a false claims investigation. That standard requires prior work to satisfy.
What that prior work looked like, in most EIDL cases, is worth understanding.
The Investigation You Did Not Know About
In 2022, the SBA’s Office of Inspector General estimated that over $200 billion in potentially fraudulent loans had been disbursed through COVID-19 relief programs. The number was large enough that Congress responded the same year by extending the statute of limitations for EIDL fraud from five years to ten, a legislative signal about the scale the government believed it was confronting and the patience it intended to exercise.
The process begins not with a person but with an algorithm. The SBA and its Inspector General execute pattern-detection analytics across the full population of approximately 3.9 million EIDL loans, searching for deviations from what a legitimate application should produce: multiple loans traced to the same IP address, loan amounts inconsistent with the applicant’s prior tax filings, businesses absent from state incorporation records, applications submitted from foreign IP addresses for domestic enterprises. When a loan is flagged, the file is pulled. The OIG reviews the application, cross-references public records, and checks the applicant’s identifying information against other pandemic loan databases for duplicate submissions.
Some flagged files go no further. The inconsistency turns out to be clerical. The dollar figure is too modest to justify what comes next.
But a meaningful number of files are referred onward: to the FBI, to IRS Criminal Investigation, to the DOJ’s Civil Division, or to one of five COVID-19 Fraud Enforcement Strike Force units stationed in Maryland, South Florida, New Jersey, Colorado, and California. These units exist for the sole purpose of converting algorithmic flags into criminal and civil cases. They are staffed with dedicated prosecutors and agents drawn from multiple federal agencies. By December 2024, the broader Task Force had charged over 3,000 defendants and secured more than 2,500 guilty pleas or convictions. The SBA OIG alone had produced over 1,200 criminal indictments.
And in a substantial number of cases, the investigation was not initiated by the government at all. The False Claims Act contains a qui tam provision that permits private individuals (known as relators, and often someone closer to the borrower than the borrower would prefer to consider: a former business partner, a departing bookkeeper, an accountant who noticed where the EIDL proceeds actually traveled) to file suit on behalf of the United States. The complaint is filed under seal. The government then investigates whether to intervene. The CID, in such a case, is the government’s tool for evaluating the relator’s claims. You may have been under investigation for a year or more before you learned of it. The sealed complaint would have given you no indication.
I cannot say with certainty, in any given case, whether a CID originates from the government’s own data analytics or from a whistleblower action. The government does not always disclose which path brought it to the borrower’s door. The practical difference at the moment you receive the document may be small. The strategic difference later, when your counsel is determining how the case was constructed and what the government already possesses, is not.
Whether the investigation was data-driven or relator-driven, the CID represents a point at which the government has assembled enough preliminary evidence to justify a formal demand under the False Claims Act. What preceded the envelope was months of work you were not invited to observe.
What the Document Demands
Under 31 U.S.C. § 3733, a CID can take three forms: a demand for documentary material, a demand for written answers to interrogatories, or a demand for oral testimony. In the EIDL context, the demands we have reviewed tend to emphasize the first category. They request bank records, tax returns, the original loan application, correspondence with the SBA, records showing how loan proceeds were disbursed, corporate formation documents, and financial statements for the periods before and after the loan was received. The scope is broad. The timeline for compliance is not generous.
The government is not confined to serving a CID on the suspected wrongdoer. The statute authorizes service on any person believed to possess relevant information about an FCA violation. You may receive a CID not because the government suspects you of fraud but because it suspects someone connected to you, a business partner, a loan preparer who filed on your behalf, and believes your records will clarify their conduct. The document should specify the nature of the alleged violation. It will not tell you whether the government regards you as a subject, a target, or a witness.
That ambiguity is, if we are being precise, not accidental.
The Reassurance That Dissolves on Examination
The standard comfort offered in every article on this subject is that receiving a CID does not mean you have committed a crime. The statement is correct and also insufficient, in the way that telling someone the parachute was packed by a professional is correct without being the same as telling them it will open.
A CID is a pre-litigation investigative tool. The government issues it before filing a formal False Claims Act action, or during the sealed period when it is evaluating whether to intervene in a qui tam suit. The fact that a CID has been issued means the government has not reached a conclusion. There is space to influence the outcome. That space is real.
What is also real is that the information you provide in response to the CID constitutes the material upon which the government’s decision will rest. Every document you produce, every interrogatory you answer, every statement you make or decline to make will enter a calculus that results in one of three outcomes: civil suit, criminal referral, or closure. Your response is not a formality. It is the evidence.
The civil and criminal tracks run closer together in pandemic fraud enforcement than most borrowers appreciate. A False Claims Act civil action carries treble damages and per-claim penalties that exceed $27,000 per violation. The SBA loan documents themselves provide that a borrower who wrongfully misapplies funds is civilly liable for one and a half times the original principal under 15 U.S.C. § 636(b). A civil investigation can generate evidence that results in a criminal referral (wire fraud carries up to twenty years; bank fraud, thirty), and a criminal investigation can produce a parallel civil action. The wall between the two is permeable.
Three cases came through our office last year where what began as a civil inquiry became a criminal one after the documents were reviewed. In each instance, the borrower had treated the CID as a nuisance rather than as what it was.
Whether a particular court would treat a given set of facts as civil negligence or criminal intent is a question that depends on variables too numerous and too case-specific to generalize about from this desk.
The Ten-Year Clock
The COVID-19 EIDL Fraud Statute of Limitations Act of 2022 extended the prosecution window to ten years. If you received your loan in June of 2020, the government has until June of 2030 to bring charges. If your last relevant act, a loan modification request, a statement to an investigator, an application for additional funds, occurred in 2022, the window extends to 2032.
The extension was bipartisan and purposeful. The SBA disbursed roughly $390 billion through the EIDL program. Over 1.3 million borrowers are in default as of early 2026. The investigative apparatus cannot process that volume quickly, and Congress ensured it would not have to.
The statute is not entirely clear on every question of tolling and accrual, which is part of the problem for borrowers who assume the clock started on the day the loan was funded. If a false statement was made in connection with a later event, the repayment deferral process, for instance, the clock may have started later than you think.
What to Do with the Document in Your Hand
Before anything else, read the CID in its entirety. Read the statutory citation. Read the description of the alleged conduct. Read the deadlines and the specific categories of documents demanded. Most borrowers who call our office have read the first page and the last and have guessed at the rest. The middle pages contain the specifics that will determine the scope and cost of your response. They deserve the same attention one would give a contract before signing it.
Do not respond without counsel. This is not a recommendation made for the sake of professional revenue. A CID carries the force of federal law. You cannot ignore it; the DOJ can petition a court to compel compliance, and noncompliance invites penalties. But you are not obligated to produce everything demanded without negotiation. CIDs in this area are often overbroad (one recipient in a case from the Western District of Virginia was required to produce hundreds of thousands of documents before the government would even discuss the scope of its investigation), and the process of narrowing the demand to something proportionate requires a particular kind of experience.
Your counsel’s first task is to contact the issuing office and confirm representation. This step, which sounds clerical, establishes the attorney-client relationship with the government, routes all communication through your lawyer, and creates a record that you are cooperating.
The second task is to reconstruct your loan file before producing anything. This means:
- Locate your original EIDL application (request a copy from the SBA if you do not have one).
- Gather the tax returns you submitted or that the SBA obtained through IRS Form 4506-T.
- Collect bank statements for the twelve months before and after disbursement.
- Assemble records of how the proceeds were spent: invoices, payroll records, rent receipts, supplier payments.
- If you used accounting software, export the relevant data for the covered period.
The purpose of this reconstruction is not merely compliance. It is preparation. Your counsel needs to understand the complete picture before any document leaves your possession, because the government will compare what you produce against what you represented on the application, and any discrepancy will require explanation. If the application overstated revenue, you want to know that before the government informs you. If the funds were applied to a purpose not covered by the loan agreement (the EIDL was restricted to fixed debts, payroll, accounts payable, and operating expenses that could have been met absent the disaster), your counsel needs to assess the nature and degree of the deviation. Lying to federal investigators during this process is a separate offense under 18 U.S.C. § 1001. Five years. Its own limitations period.
Constitutional protections apply, though they do not apply themselves. Attorney-client privilege shields communications between you and your counsel from disclosure. The Fifth Amendment right against self-incrimination may limit what you are required to produce, particularly if the civil investigation carries criminal implications. These protections must be asserted, and the assertion must be calibrated. An overbroad claim of privilege can erode the goodwill that exists at this stage of the process; too narrow a claim can result in producing materials that were legitimately shielded.
The borrower who treats a CID as a collection letter will respond as if the objective is to make the problem disappear. The borrower who treats it as a demand issued under the False Claims Act will respond as if the objective is to control what the government learns and in what sequence it learns it.
In something like forty of the pandemic loan matters we have handled, the clients who fared best understood that the CID was an opportunity to present their account before the government’s theory solidified into a conclusion. The window for that presentation is not indefinite.
The Principle Beneath the Procedure
The EIDL program distributed its funds during a period of genuine emergency, under conditions that the SBA’s own Inspector General has acknowledged outpaced the agency’s capacity to verify eligibility. The government knows this. It is possible, at this point in the enforcement cycle, to observe a pattern in how prosecutors approach these cases: the borrower who made a good-faith application and can demonstrate where the money went receives a different kind of attention than the borrower who fabricated a business, submitted false tax documents, and transferred the proceeds into a personal account within days of receipt.
For those who obtained an EIDL loan for legitimate reasons and used the proceeds as the program intended, the CID is an occasion to demonstrate that, to present the documentation and let the file speak. For those whose applications contained errors, whether careless or otherwise, the CID is an occasion to address the discrepancy before it compounds into something more consequential. A consultation with our office assumes nothing and costs nothing; it is the point at which the situation becomes a problem shared rather than a problem carried alone.
There is a particular stillness in the days between receiving a federal demand and deciding what to do about it. I have heard it described many ways. None of the descriptions were wrong.