Your Paycheck Protection Program loan was forgiven in 2021. You filed the paperwork, spent the money on payroll, and moved on. So why could you still get a letter from the Department of Justice in 2028?
Because for PPP loans, forgiveness did not end the clock — it started a different one. Congress extended the statute of limitations for PPP-related fraud to 10 years, which means loans you originated in 2020 remain enforceable until 2030, and 2021 loans until 2031. And the DOJ just posted its largest False Claims Act recovery year ever, with PPP cases still very much on the target list.
If you borrowed under PPP, the question is not whether your loan was forgiven. It is whether you can still prove, with records, that you were eligible, calculated the amount correctly, and used the funds as certified — six years after you thought you were done.
The 10-Year Clock Most Borrowers Forgot About
From five years to ten
When PPP launched in March 2020 under the CARES Act, most federal fraud offenses carried a five-year statute of limitations under 18 U.S.C. § 3282. That would have meant 2020 loans would have timed out in 2025.
On August 5, 2022, President Biden signed two bipartisan bills that changed the math:
- The PPP and Bank Fraud Enforcement Harmonization Act of 2022
- The COVID-19 EIDL Fraud Statute of Limitations Act of 2022
Together they established a 10-year limitations period for both criminal charges and civil enforcement actions tied to PPP and COVID-EIDL fraud. The False Claims Act itself normally has a six-year limitations period under 31 U.S.C. § 3731(b) — Congress imposed a flat 10 years for these pandemic programs, which is now the longest FCA-related window available.
Practical result:
- A PPP loan funded on April 15, 2020 can be charged until April 15, 2030
- A Second Draw loan funded on March 10, 2021 can be charged until March 10, 2031
Forgiveness does not cut the period short. The clock runs from the offense date (typically the application and certifications), not from the forgiveness date.
Why the extension matters now
Early PPP enforcement focused on the most obvious fraud: shell companies with no payroll, borrowed identities, multiple loans to the same business. Much of that was prosecuted quickly under wire fraud and bank fraud statutes.
What is happening now is different. The government has had five years to build datasets and is shifting to subtler eligibility and certification questions that require no undercover work — just data matching and document review. A business that was operating, had real employees, and fully intended to comply can still face a False Claims Act inquiry if its application was inaccurate on affiliation, headcount, necessity, or payroll calculation.
And the government has made clear it is not slowing down. On January 16, 2026, the DOJ announced that False Claims Act settlements and judgments exceeded $6.8 billion in fiscal year 2025 — the highest single-year recovery in the statute's history. Whistleblowers filed 1,297 qui tam actions and the DOJ opened 401 new FCA investigations in the same year. Health care fraud still dominates the dollars, but the DOJ specifically highlighted procurement, loan and grant fraud — and PPP cases featured prominently in the annual review, including a June 2025 settlement where three affiliated companies that were too large to qualify paid $13 million to resolve allegations they improperly obtained PPP loans and forgiveness, with $2.34 million going to the whistleblower.
In plain terms: you are now past the halfway mark of a decade-long enforcement window, and the enforcement infrastructure — funding, data tools, and whistleblower incentives — is larger than at any point during the pandemic.
What the False Claims Act Means for a PPP Borrower
Most borrowers think of PPP risk as criminal fraud. The False Claims Act (FCA) is the more likely civil path — and it is expensive.
How FCA liability works
The FCA, 31 U.S.C. §§ 3729–3733, imposes liability on anyone who knowingly submits, or causes to be submitted, a false claim for government money, or makes a false statement material to such a claim. "Knowingly" under the FCA does not require specific intent to defraud. It includes:
- Actual knowledge — you knew the statement was false
- Deliberate ignorance — you ignored a clear truth you had a duty to verify
- Reckless disregard — you submitted a certification without reasonable diligence
PPP loans involved certifications to the Small Business Administration that borrow the FCA's language almost verbatim. Every borrower certified, under penalty of perjury, that:
- The business was eligible under the CARES Act rules in effect at the time
- Funds would be used for permitted purposes (payroll, rent, utilities, mortgage interest under the rules then applicable)
- Information provided was true and accurate in all material respects
- For Second Draw, the 25% revenue-reduction test was met
A false certification that was material to the SBA's decision to guarantee and later forgive the loan can form the basis for an FCA case, even if the money was eventually spent on payroll.
The penalties
FCA cases carry:
- Treble damages — three times the government's actual loss (typically the loan amount plus forgiven interest, or the forgiven amount if the loan was forgiven)
- Per-claim civil penalties — adjusted annually for inflation, currently $13,946 to $27,894 per false claim (2025 levels, adjusted yearly)
- Relator share — if a whistleblower (often a former employee, bookkeeper, or business partner) files a qui tam suit, they receive 15% to 30% of the recovery
- Attorneys' fees and costs
A $200,000 PPP loan that is found to have been obtained on a false eligibility certification could theoretically produce $600,000 in treble damages plus per-claim penalties, before fees — even if every dollar was paid to employees. That is why the DOJ pursues these cases civilly: the leverage is enormous and the burden of proof is preponderance of the evidence, not beyond a reasonable doubt.
Forgiveness is not a defense
This is the most dangerous misunderstanding. The SBA's decision to forgive a loan does not immunize the underlying certifications from review. Under the loan forgiveness rules and subsequent interim final rules, the SBA retains authority to review and audit any PPP loan and to revoke a prior forgiveness decision — typically for up to six years after forgiveness for loans over $150,000 — if it later determines the borrower was ineligible or made material misrepresentations.
Separately, the DOJ can bring an FCA case within the 10-year window regardless of what SBA did on forgiveness. In recent lender-focused enforcement, the DOJ has emphasized that the forgiveness review process itself — the documentation the lender relied on — is within its enforcement lens.
The Five Eligibility Tripwires That Still Generate Cases
You do not need to have invented a fake business to create exposure. In the cases the DOJ has described since 2024, the recurring issues are all things a rushed owner or an outside preparer could get wrong in April 2020:
1. Size and affiliation
PPP eligibility was generally limited to businesses with 500 or fewer employees, with complex affiliation rules that aggregated employees across common control and ownership. A company with 350 employees that owned or was owned alongside two other operating companies with 100 employees each was potentially aggregated to 550 — over the cap — even if each entity applied separately. Affiliation waivers existed for specific NAICS codes and for certain other structures, but they had to be applied correctly on the day you certified.
Recent settlements have involved affiliated groups that applied entity-by-entity without combining headcount. The defense that "each company was under 500" fails if common ownership or management triggered affiliation under 13 C.F.R. § 121.301(f).
2. The necessity certification
First-draw borrowers certified in good faith that "[c]urrent economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant." Later guidance created safe harbors — for example, loans under $2 million were deemed to have made the certification in good faith at the time — but the certification was evaluated based on facts at application, not hindsight.
Borrowers with substantial cash on hand, access to undrawn credit lines, or public-company parents faced the most scrutiny, but even smaller borrowers who distributed large owner dividends or made acquisitions shortly after funding have been asked to justify the certification.
3. Payroll-cost calculation
PPP loan amounts were calculated from payroll costs as defined by the program — salary, wages, commissions, group health premiums, retirement contributions, and state/local payroll taxes — capped at $100,000 annualized per employee. Common errors that change the loan amount:
- Including independent contractor payments (1099 compensation) in payroll — not permitted; contractors could apply on their own
- Including the employer share of federal payroll taxes
- Annualizing the wrong reference period or cherry-picking a peak month for seasonal businesses without using the permitted alternatives
- Omitting the $100,000 cap per person
An inflated payroll figure that produced a larger loan is a straightforward false claim if the calculation method was misapplied, even absent intent.
4. Second Draw revenue-reduction test
Second Draw PPP (January 2021 onward) required that the borrower had experienced a 25% or greater reduction in gross receipts between comparable quarters in 2019 and 2020, among other conditions. The SBA allowed borrowers to use annual comparisons as an alternative under certain rules, but the definition of gross receipts followed tax-return concepts.
Errors here are easy to make: using net receipts after returns, excluding grant income that should have been counted, or picking non-comparable quarters. Because eligibility for Second Draw hinged entirely on this test, a failure — even one the borrower believed was immaterial — can taint the entire second loan.
5. Use of proceeds and forgiveness payroll math
PPP funds had to be used for eligible purposes, with at least 60% for payroll costs to qualify for full forgiveness under the current rules (originally 75%). Forgiveness then required FTE and salary-reduction calculations and documentation of covered-period spending. A borrower that shifted PPP dollars to non-payroll uses beyond the allowed percentage, or reduced headcount or wages without applying the safe harbors correctly, could face both a forgiveness reduction and an FCA question about whether the forgiveness application misrepresented payroll or FTE figures.
Two Clocks You Need on Your Calendar
Borrowers and lenders are subject to different record-retention rules — and both are longer than most businesses keep routine files by default.
Borrower retention: six years after forgiveness or repayment
The SBA requires every PPP borrower to retain all records relevant to the loan and forgiveness — including the loan application, supporting payroll documentation, affiliation analysis, necessity basis, use-of-proceeds evidence, and forgiveness application and supporting schedules — for six years after the date the loan is forgiven or repaid in full. Six years is not arbitrary: it mirrors the FCA's six-year limitations period (extended to 10 for PPP).
During that period, borrowers must permit authorized representatives of the SBA, including its Office of Inspector General, to access the files.
Practical example: if your loan was forgiven on October 15, 2021, your retention obligation runs to October 15, 2027 — well within the 10-year enforcement window. Lose the 2019 quarterly payroll register that supported your loan amount, and you lose the ability to prove a 2026 inquiry wrong.
Lender retention: ten years from final disposition
On August 23, 2024, the SBA published an interim final rule (89 FR 68090) extending PPP lender record-retention requirements to ten years from the date of final disposition of each PPP loan — the date the loan is paid, forgiven, charged off, or otherwise resolved. The rule was effective immediately precisely because the SBA determined that delaying for notice-and-comment would risk loss of records needed for law enforcement.
Why this matters to you as a borrower: even if you discarded your copy, your lender still has one, and the DOJ can subpoena it. Consistency between what you told the lender at origination, what you told the SBA at forgiveness, and what your tax and payroll filings showed is what investigators will test.
SBA's own six-year audit window
For loans over $150,000, the SBA has generally taken the position it can review and question eligibility, loan amount, use of proceeds, and forgiveness for up to six years after forgiveness. For smaller loans, the practical audit risk after forgiveness was lower under the streamlined processes, but the DOJ's FCA window is independent of dollar threshold. Forgiven or not, under-$150K loans can still generate qui tam cases.
What Data-Driven Enforcement Looks Like in 2026
Early PPP investigations were tip-driven. Current enforcement is database-driven. The DOJ and SBA OIG now routinely cross-reference:
- SBA PPP origination and forgiveness data against IRS Form 941 quarterly payroll and business tax returns
- State unemployment-insurance wage records against certified FTE and payroll figures
- Business-license and incorporation dates against the "in operation on February 15, 2020" requirement
- Affiliation signals — common addresses, common owners, shared TIN patterns — against separate loan applications
- EIDL and PPP applications from the same entity for inconsistent revenue or employee counts
AI-assisted mining does not prove fraud by itself, but it generates the target list. A common scenario described by counsel who defend these matters: a business receives a Civil Investigative Demand (CID) years after forgiveness asking for the underlying payroll ledgers, health-insurance invoices, and ownership charts that supported a one-page 2020 certification — and the business must reconstruct the answer from whatever survived a 2022 bookkeeper turnover and a 2024 accounting-system migration.
Qui tam whistleblowers accelerate the same dynamic. Any person with non-public information about a false claim — including a current or former employee or an outside accountant — can file a qui tam suit under seal. The DOJ investigates quietly, then decides whether to intervene. The whistleblower's 15%–30% share of a PPP recovery that might be several hundred thousand dollars is a strong incentive to file, and the 2025 figure of nearly 1,300 new qui tam actions is the second-highest year on record.
What to Do If You Borrowed Under PPP
If your loan was repaid or forgiven and you have heard nothing, that does not mean the file is closed. Use the remaining years of the window to make your documentation audit-ready, not to hope the window shortens.
1. Locate and protect the full loan file
Assemble a single PPP archive — digital and backed up — that contains:
- The SBA Form 2483 (or lender equivalent) and every version submitted, with all addenda
- Payroll-cost support for the reference period you actually used (941s, payroll registers, health-insurance premium invoices, retirement-plan contribution records)
- Affiliation analysis: ownership charts, cap-table or operating-agreement excerpts showing control, NAICS code determination, and any waiver you relied on
- The necessity-certification memo or notes of what facts you considered in March–April 2020 (cash position, revenue decline, access to capital, uncertainty in your industry at that time)
- For Second Draw: gross-receipts workpapers showing the 2019 vs. 2020 quarter or annual comparison, tied to your books and returns
- Bank statements showing receipt and use of PPP proceeds, and the covered-period payroll and rent/utility payment evidence
- The forgiveness application (3508, 3508EZ, or 3508S) and every supporting schedule: FTE-average calculations, wage-reduction worksheets, safe-harbor forms
- EIDL applications, if any, for the same period — to confirm consistency
Retention test: could a stranger reconstruct exactly how you answered every certification from this folder alone, without calling anyone who worked for you in 2020?
2. Self-audit the certifications before someone else does
Run a friendly review now, ideally with counsel and a CPA under a privilege structure:
- Recompute payroll costs using the PPP definition, not your normal P&L payroll line, and cap each person at $100,000 annualized
- Re-test affiliation under 13 C.F.R. § 121.301 as it existed when you applied — the rules were later simplified, but your certification is judged on contemporaneous guidance
- For Second Draw, tie gross receipts directly to your general ledger and filed returns — do not rely on a spreadsheet that no longer footnotes its sources
- Compare every figure you gave SBA or the lender to the corresponding IRS and state filing. If the numbers differ, document why, contemporaneously
Finding an error now does not fix it retroactively, but understanding it lets you make an informed decision about disclosure, repayment, or positioning — rather than improvising under a CID deadline.
3. Understand the difference between error and fraud
Not every miscalculation becomes an FCA case. The DOJ exercises discretion under the Justice Manual's FCA factors and under specific PPP guidance and typically weighs:
- The size of the error relative to the loan
- Whether the error was conservative or self-serving
- Whether the business corrected or disclosed once aware
- Sophistication and access to professional advice
- Whether funds were actually used for payroll and retention
A $12,000 payroll overstatement on a $180,000 loan where the business retained headcount and spent 70% on payroll is a very different fact pattern from three affiliated entities each claiming 400 employees to stay under 500. But both start with a document request — and counsel's ability to show diligence depends on the workpapers you kept, not the good intentions you remember.
4. Have a response plan
Decide now who opens the mail that matters:
- Who is the point of contact for an SBA review, DOJ CID, or qui tam notice (hint: it should not be the office manager who files the mail)?
- Which law firm and accounting firm would handle a PPP inquiry under privilege?
- Where is the 2020–2021 email and chat archive, and has any routine deletion policy already destroyed responsive messages?
Many small businesses lose PPP matters on process, not substance: they respond late, respond through the wrong person, or produce inconsistent records from three places that tell three stories. A one-page response protocol prevents that.
5. Do not ignore small loans
Borrowers with loans under $150,000 that used Form 3508S and received automatic forgiveness sometimes assume they were never reviewed and never will be. The streamlined forgiveness reduced SBA pre-forgiveness review for small loans, but qui tam relators face no dollar threshold, and the DOJ's data matching has no minimum loan size. The same 10-year clock applies.
How Good Bookkeeping Turns a Six-Year Burden Into a One-Hour Answer
If there is a single practical lesson from the shift to data-driven FCA enforcement, it is that the paper you keep matters more than the loan amount you received.
About 40% of the forgiveness inquiries that advisors describe as stressful but ultimately defensible share the same root cause: the business spent the money correctly but cannot prove it on demand, because the proof lived in a payroll provider portal whose report was downloaded once and never saved, in a health-insurance invoice that went to a former admin's email, or in a spreadsheet that was overwritten when the bookkeeper "cleaned up" the file list.
A durable PPP archive does not require an enterprise system. It requires three habits:
- Keep source documents, not just summaries. The SBA and DOJ want the payroll register by pay date and employee, the health-insurance carrier invoice, the retirement-plan remittance, the utility statement with service address — not a PDF that says "Payroll $412,000" in a single cell. Save the underlying statements and tie them to the summary with a cover reconciliation.
- Version-control the calculations. When payroll rules changed four times in four months in 2020, many businesses submitted two or three versions of the same form. Keep each version, note which one was filed, and keep the forgiveness version separate. A single "final" folder that overwrote drafts erases the audit trail you need when an investigator asks which period you used.
- Reconcile PPP figures to the books you already keep. Your gross-receipt comparison for Second Draw should foot to your sales ledger and to the revenue line on your return. Your FTE schedule should foot to the payroll system headcount report. Breaks between these sources are where questions start — closing them now is cheaper than explaining them later.
In plain terms: forgiveness was an event, but the six-year borrower retention period and the ten-year enforcement period make PPP a record-keeping obligation that outlives the loan by years. Treating it like any other seven-year tax file — boxed, labeled, and reproducible — is the cheapest insurance you can buy.
The Bottom Line: 2020 Paperwork Has a 2030 Tail
PPP was designed to be fast during an emergency. Enforcement is designed to be patient afterward. The 2022 extension to ten years guaranteed that even the earliest loans would be enforceable well past the current moment, and the record FY2025 FCA results — $6.8 billion recovered, 1,297 new whistleblower suits, a steady stream of PPP settlements into 2026 — confirm that pandemic lending remains an active docket, not a closed chapter.
You cannot shorten the window. You can decide what it finds if your file is pulled. Pull the PPP folder off the shelf this month, fill the gaps while the bookkeeper who prepared the 941s and the payroll provider who holds the 2020 registers are still reachable, and store the result where a future you — or a future reviewer — can answer the certifications without a scavenger hunt.
That diligence will not guarantee you never hear from the government. It will guarantee that if you do, you are answering from records, not from memory.
Simplify Your Financial Management
Whether you are still retaining PPP documentation or just trying to keep payroll, revenue, and use-of-proceeds records reconcilable for the next audit, clear books are what turns a request for proof into a quick export. Beancount.io provides plain-text accounting that is transparent, version-controlled, and AI-ready — so every number you reported has a source you can still show years later. Get started for free and give your future file review a clean trail to follow.