What Is the Penalty for Lying on a PPP Loan Application?

What Is the Penalty for Lying on a PPP Loan Application?

The penalties are federal, they are accumulating, and they have not begun to slow down. In February 2026, a judge in the Middle District of Pennsylvania sentenced the last of four defendants in an $11.5 million PPP and EIDL fraud conspiracy to eight years in federal prison, with restitution exceeding two million dollars. The scheme involved roughly 120 fraudulent applications submitted on behalf of dormant businesses that had no employees and no operations. One defendant spent his share on a trip to Las Vegas. The sentences across the group ranged from a year of home detention to a full decade of incarceration, and the difference between those outcomes was not a matter of judicial temperament. It was a matter of arithmetic.

The penalty for lying on a PPP loan application is not a single number printed on a statute. It is a product of the federal sentencing guidelines, the specific charges the government selects, the amount of loss the court attributes to the defendant, and a series of enhancements that most people encounter for the first time in a presentence report. The statutory maximums are severe. The sentences imposed depend on a formula, and the formula begins with money.

Federal Charges in PPP Fraud Cases

The CARES Act, which established the Paycheck Protection Program in March 2020, contains no criminal penalty of its own. The program was necessary. It was also, by design, inattentive to the conditions that produce fraud. Every prosecution relies on preexisting federal statutes, and the government selects among them according to the facts.

Bank fraud under 18 U.S.C. § 1344 carries a statutory maximum of thirty years in prison and a fine of up to one million dollars. Wire fraud under § 1343 carries up to twenty years per count. Making false statements to the SBA or to an FDIC-insured institution under § 1014 also carries up to thirty years and a million-dollar fine. These numbers are ceilings. No federal judge imposes a thirty-year sentence for a single inflated payroll figure on one application.

The ceilings matter because they define the range of what a prosecutor can threaten during plea negotiations, and the overwhelming majority of PPP fraud cases resolve through pleas. The defendant who overstated employee headcount on a single application occupies a different position from the defendant who filed fourteen applications under fictitious business names. Both face federal felony charges. The difference between their sentences is determined by loss amount and role, not by the label on the indictment.

Conspiracy under 18 U.S.C. § 1349 applies when the scheme involved more than one participant, and the penalty mirrors the underlying offense. If the underlying charge is bank fraud, the conspiracy ceiling is thirty years. Aggravated identity theft under § 1028A adds a mandatory two years of consecutive imprisonment that the sentencing judge cannot reduce or merge with the primary sentence. Money laundering under § 1956 can add another twenty years per transaction. The charges stack. Prosecutors select from them the way an architect selects materials, with an eye toward the structure they intend to construct.

Sentencing Guidelines and Loss Calculation

Under the United States Sentencing Guidelines, fraud cases begin at a base offense level of seven under § 2B1.1. The number increases with the amount of loss. A fraud between fifteen thousand and forty thousand dollars adds four levels. Between ninety-five thousand and one hundred fifty thousand, the addition is eight levels. Between two hundred fifty thousand and five hundred fifty thousand, the guideline adds twelve. The scale is not linear. The distance between a fifty-thousand-dollar fraud and a three-hundred-thousand-dollar fraud is the distance between a guideline range that contemplates probation and one that recommends years of confinement.

The critical distinction, and the one most defendants learn after indictment rather than before it: the guidelines measure intended loss, not actual proceeds. If the application sought two hundred thousand dollars but only fifty thousand was disbursed before the scheme was detected, the court calculates based on two hundred thousand. The defendant’s culpability is measured by what was attempted. This is, if we are being precise, not a natural principle but a policy choice embedded in a sentencing manual that most people will never read, and it produces outcomes that feel disproportionate to defendants who received less than they requested.

A first offender with no criminal history falls into Criminal History Category I. Combined with the total offense level, the guidelines produce a sentencing range. At offense level fifteen, the range is eighteen to twenty-four months. At level twenty-one, it is thirty-seven to forty-six months. At level twenty-seven, seventy to eighty-seven months. Judges depart from these ranges, but the departure requires justification, and the guideline range remains the center of gravity in every federal sentencing proceeding.

Enhancements accumulate. Sophisticated means (fabricated tax documents, forged bank statements, schemes coordinated across multiple entities) adds two levels. Abuse of a position of trust adds two more. A leadership or organizer role in a scheme involving five or more participants can add four. In the Middle District of Pennsylvania case, the lead defendant received a sentence roughly double that of the lowest participant, and the disparity was attributable to these enhancements and little else.

The number on the sentencing table is where the negotiation begins. Everything before it (the charge, the plea, the cooperation agreement) is an argument about which cell in that table applies.

Acceptance of responsibility, demonstrated in practice through an early guilty plea, reduces the offense level by two or three levels. Cooperation with prosecutors, formalized through what is called a 5K1.1 motion, can produce a sentence below the guideline range. These are the mechanisms through which defendants exercise whatever influence remains after the loss figure has been set. For a first offender who obtained a PPP loan of something like two hundred eighty thousand dollars and spent part of it on personal expenses, the guideline range after enhancements and reductions often lands between two and four years. For the defendant who filed dozens of applications under names that did not correspond to real businesses, the range begins at seven or eight years.

I am less certain about how uniformly these ranges translate into actual sentences across districts. A judge in the Southern District of New York may view a particular loss amount with less severity than a judge in the Eastern District of Texas, and the factors set forth in 18 U.S.C. § 3553(a), which govern all federal sentencing, leave room for considerations that the guidelines do not capture: the defendant’s personal history, the need for deterrence, the circumstances of the offense as a human event and not merely a financial one. The guidelines provide a range. The sentence occupies a point within it, or outside it, depending on arguments made in a particular courtroom on a particular morning.

Civil Exposure Under the False Claims Act

The criminal penalty is not the only consequence.

The False Claims Act, 31 U.S.C. § 3729, permits the government to recover treble damages for fraudulent claims submitted to federal programs. A defendant who obtained a hundred-thousand-dollar PPP loan through fraud faces civil liability of three hundred thousand dollars before per-claim penalties are assessed. The standard of proof is preponderance of the evidence. The government does not need a criminal conviction to proceed.

These cases are filed with increasing frequency not by DOJ attorneys but by whistleblowers. Qui tam actions under the FCA allow private individuals to sue on the government’s behalf and collect a percentage of the recovery. In fiscal year 2025, whistleblowers filed 1,297 new qui tam suits, a record. The relators in PPP cases are often data miners: firms and individuals who cross-reference publicly available PPP loan data against corporate filings, tax records, and employment databases. The PPP data is public because the program was public. The matching is algorithmic. A business owner who believes the criminal statute of limitations is the only timeline that matters is operating under an incomplete understanding.

The Statute of Limitations

In August 2022, President Biden signed the PPP and Bank Fraud Enforcement Harmonization Act into law. The House passed it 421 to zero. The statute established a uniform ten-year limitations period for all PPP fraud, criminal and civil, regardless of whether the loan originated through a traditional bank or a fintech lender.

Before the Act, the distinction between lender types produced a consequential gap. PPP fraud through a bank could be charged as bank fraud, which already carried a ten-year statute of limitations. Fraud through a fintech (and fintech lenders processed a disproportionate share of the applications that have since been flagged as suspicious) could only be charged as wire fraud, with a five-year window. A borrower who applied through an online lender in April 2020 would have seen that exposure expire in April 2025. Congress eliminated the discrepancy. The political calculation was not complicated: in an election year, no member could afford to appear protective of pandemic fraud.

The ten-year period does not begin on the date the application was submitted. It begins on the date of the last fraudulent act connected to the loan. For borrowers who submitted false certifications during the forgiveness process, which in many cases occurred a year or more after the initial disbursement, the clock starts later than they assume. A loan received in May 2020, with a forgiveness certification filed in September 2021, carries a limitations period that extends into 2031.

Forgiveness and prosecution occupy separate tracks. The SBA’s decision to forgive a loan is an administrative determination about the use of funds. It has no bearing, none, on whether the Department of Justice can charge the borrower with fraud in obtaining those funds. I have spoken with business owners who believed forgiveness was exoneration. It is not. The two processes do not communicate in the way most borrowers expect.

Enforcement Posture

Six years after the first PPP loans were disbursed, the DOJ has not shifted its attention elsewhere. In fiscal year 2025, False Claims Act settlements and judgments across all federal programs exceeded $6.8 billion, a record figure. Civil recoveries attributed to pandemic fraud, drawn from over two hundred settlements and judgments, represent a substantial and growing share.

The criminal enforcement is active at every scale. A jury in the Northern District of Georgia convicted a defendant in July 2025 on bank fraud, wire fraud, and money laundering charges arising from a $9.6 million scheme. The founders of Blueacorn, a fintech company that had processed PPP applications for small businesses, were each sentenced to ten years after pleading guilty to conspiracy; they had fabricated documents to secure larger loans and charged borrowers illegal fees calculated as a percentage of the funds received (a practice that was profitable enough to generate restitution orders totaling nearly $130 million between them, which gives some indication of the scale of the underlying conduct).

But the category of defendant whose prosecution has grown most visible is the preparer. In 2025, an Illinois tax preparer received forty-two months for securing over three million dollars in fraudulent PPP loans on behalf of clients he knew were ineligible. The theory is not complicated: the preparer caused false statements to be submitted to a federal agency. The person who signed the application and the person who completed it both face exposure under the same statutes. Whether the preparer or the borrower bears greater culpability is a question the guidelines address in each case on its own facts, and the answers have not been uniform.

The DOJ has also signaled that data analytics and interagency coordination have changed the investigative process in ways that earlier fraud cycles did not contemplate. The SBA maintains loan data. The IRS holds reported income. State unemployment records reflect employee headcount. When these databases are compared, discrepancies surface with a regularity that does not require human intuition. The enforcement pipeline is not winding down. The ten-year statute of limitations means the cases being investigated today may not be filed for years, and the cases filed today were investigated over the preceding three or four.

What This Means in Practice

The question most people ask is whether the government will pursue their case. The answer depends on variables that the borrower may not be in a position to assess: the size of the loan, the nature of the misrepresentation, whether the borrower’s name has appeared in a whistleblower complaint, and whether the investigation has already begun without the borrower’s knowledge. Federal investigations do not announce themselves until they are ready to.

What one can say with confidence is that the program was designed for speed and the enforcement was designed for patience. The penalties for PPP fraud are the penalties for federal fraud generally, applied with a specificity that reflects how much data the government possesses about every loan that was disbursed. The application itself, the payroll figures, the certifications, these are documents that exist in electronic form, in permanent federal storage, and are now subject to comparison against tax records and corporate filings that the borrower cannot alter after the fact.

For anyone who has received a letter, a subpoena, or a call from a federal agent, a consultation is where this conversation begins. A first call costs nothing and assumes nothing; it is the beginning of a diagnosis, and in this area of law, the distance between early intervention and late response is often the distance between a manageable outcome and one that is not.