If you received a PPP loan during the COVID-19 pandemic, the main question has shifted from, "How do I spend this?" to, "Can I show I spent it correctly?" And for those investigating, the question has shifted from, “Is this a fraudulent application?” to, “Was this an eligible or fraudulent loan, and was its forgiveness handled correctly?”
Audits, U.S. Department of Justice (DOJ) investigations, and whistleblower lawsuits are still active years after most loans were disbursed and forgiven. The good news is that the same practices that kept you compliant in 2020 will still protect you now. Here's what to keep in place to avoid PPP loan fraud.
Keep your payroll and wage records consistent with what you certified
Investigators have flagged businesses that paid employees normally during the covered period, then clawed back wages, cut hours, or asked employees to work unpaid afterward to "make up" for it. That pattern is one of the clearest fraud signals auditors look for, and it's just as visible in your payroll history today as it was in 2020.
What you can do:
Keep your original payroll records that back up your forgiveness application accessible and unaltered.
If you ever adjusted wages or hours after your covered period, make sure you have a legitimate, documented business reason unrelated to the loan.
Revisit your good-faith necessity certification
Every PPP borrower certified that the loan was "necessary to support ongoing operations." That certification didn't expire when your loan was forgiven, and it's one of the first things the DOJ and Small Business Administration Office of Inspector General (SBA-OIG) examine now, especially for loans that drew attention for their size or the borrower's other access to capital.
What you can do:
Hold onto whatever documentation you had at the time showing why the loan was necessary (revenue drops, cash flow projections, other financing you considered).
If you no longer have that documentation, reconstruct what you can now, while records and memories are still available.
Retain everything for the full 10-year enforcement window, not just the standard business-record period.
Resolve any duplicate-loan issues now
Borrowers were only ever entitled to one PPP loan per tax ID. Auditors have already recovered over a billion dollars in duplicate-loan cases, and that reconciliation work continues.
What you can do:
If you're not fully sure whether your business (or an affiliate) ended up with more than one loan, check now rather than waiting for a lender or SBA notice.
If you find a duplicate, report it and repay it. Voluntary correction is treated very differently than a fraud finding made during an investigation.
For affiliated businesses, keep the eligibility analysis you used at the time on file.
Keep documenting how you spent the funds
Whether or not you were granted loan forgiveness, how you used the money still matters. If forgiveness was ever contested or partial, or if you used any funds outside payroll and other approved costs, that spending history is exactly what an auditor asks to see.
What you can do:
Keep your original expense documentation—payroll reports, rent, utilities, lender correspondence—organized and easy to retrieve.
If forgiveness is still pending or was denied in part, keep pursuing resolution with your lender.
Treat these records like tax documents. Keep them for the full 10-year statute of limitations, not the 3-4 years you might use for other business records.
Know what to do if you're contacted about an investigation
DOJ and SBA-OIG investigations, and whistleblower lawsuits filed by former employees, bookkeepers, or lenders, are still opening today. A successful whistleblower can receive 15-25% of whatever the government recovers, which is part of why this activity hasn't slowed down.
What you can do:
If you're contacted by an investigator or receive a civil investigative demand, talk to an attorney before you respond rather than trying to resolve it informally.
Run your own internal check of your PPP file now, before waiting to be asked. Businesses that can produce clean, complete documentation quickly are much better off than those that can't.
Make sure whoever handled your application and forgiveness at the time (bookkeeper, CFO, outside accountant) knows where the records live and can speak to the numbers.
Keeping organized, accurate payroll and financial records is the single biggest thing that separates a business that sails through an audit from one that doesn't.
FAQs
What's the difference between a PPP loan and an Economic Injury Disaster Loan (EIDL)?
While both were COVID-19 pandemic relief programs, they worked very differently: PPP was designed to be forgiven, while EIDL was designed to be repaid.
A PPP loan came through a bank or other approved lender, and could be fully forgiven if you spent at least 60% of it on payroll and the rest on approved costs like rent and utilities. An EIDL, by contrast, came directly from the U.S. Small Business Administration (SBA) and functions as a standard long-term loan. Only the EIDL advance (up to $10,000-$15,000, depending on when you applied) was ever a forgivable grant, while the loan itself isn't forgivable.
That distinction matters even more now. The deadline to apply for PPP forgiveness passed in March 2024, and unforgiven balances are in collections through the Treasury and IRS. EIDL loans were never forgivable to begin with, so they're simply in active repayment. The SBA has reported tens of billions of dollars in EIDL loans now in default. Many small businesses received both, but since they're separate obligations with separate rules, you should check your standing on each one individually rather than assuming they're tracked the same way.
Is it a problem if I received both a PPP loan and an EIDL?
Only if you used both for the same expenses in the same period.
The rule was that you couldn't use PPP and EIDL funds to cover the same costs during the same time period. Most commonly, that meant if you used your PPP loan for payroll during your covered period, you couldn't also use EIDL funds for payroll during that same window (even though both programs technically allowed payroll as an eligible expense). Many businesses received both loans. There’s only an issue if the same dollar of expense got covered twice.
This overlap is a documented audit trigger, so if you received both, pull your records and confirm the expenses each loan covered didn't overlap in the same period. If they did, talk to your lender or an advisor about correcting it. A self-identified overlap and an audit-identified one are treated very differently.
What triggers a PPP loan audit or investigation?
Usually, it's a mismatch between what you certified and what your data shows.
Investigators and auditors look for specific patterns that suggest a loan wasn't obtained or used as represented: a business that received more than one PPP loan (loan "stacking"), a company that was only recently formed when it applied, sudden spikes in payroll numbers right before or during the application, or atypical activity like forming new entities or taking on new debt around the same time. A lack of documented policies for how PPP funds were tracked and spent is also a flag. Auditors expect to see a paper trail, not just a memory of what happened. And if a business is slow, evasive, or unable to produce records when asked, that response is treated as its own red flag, regardless of what actually happened with the money.
Any of these flags would make an auditor likely to look closer. Businesses that can explain and document each of these patterns tend to move through review quickly; ones that can't tend to become priority cases.
Separately, some of the earliest and most heavily prosecuted PPP cases involved outright identity theft, where applications were filed using stolen personal information. That's a distinct category from the certification and documentation issues above, and it's pursued far more aggressively.
What are the consequences of PPP loan fraud?
They range from repaying the loan to facing decades in federal prison, depending on whether the case is handled administratively, civilly, or criminally.
At the administrative level, the U.S. Small Business Administration (SBA) can deny or claw back forgiveness and refer the balance to Treasury for collections. That can mean wage garnishment, seized tax refunds, and damaged credit. Civilly, the government can pursue claims under the False Claims Act, which allows for treble damages (three times the loss) plus per-claim penalties, and can be brought by DOJ directly or by a whistleblower on the government's behalf. Criminally, prosecutors typically charge wire fraud, bank fraud, and false statements to a financial institution (and money laundering, when proceeds were funneled through other accounts to disguise their source). Wire fraud alone carries up to 20 years in prison, rising to 30 years and a $1 million fine when it involves a financial institution or a presidentially declared disaster, which COVID-19 qualifies as.
A single case can involve loan repayment, civil penalties, and criminal charges at once. And because the statute of limitations runs 10 years from origination, all three remain on the table for 2020 loans through 2030 and 2021 loans through 2031.
Can I still be investigated if my PPP loan was already forgiven or fully repaid?
Yes. Forgiveness and repayment close out your loan, but they don't close out your fraud exposure.
Forgiveness only confirms that, based on what you submitted, your spending appeared to meet the program's rules at the time. It doesn't prevent the government from later determining that a certification was false or that eligibility was misrepresented. The same is true if you simply repaid the loan instead of seeking forgiveness: repayment resolves the debt, not any underlying misrepresentation made to get it.
How long do I need to keep my PPP loan records?
For 10 years from when you received the loan. For 2020 loans, through 2030; for 2021 loans, through 2031.
That timeline comes directly from the PPP and Bank Fraud Enforcement Harmonization Act of 2022. Keep your loan application, forgiveness application (if you filed one), payroll reports, and any documentation of how funds were spent.
Treat these the way you'd treat tax records tied to a major transaction: worth their own labeled folder, not mixed in with records you'd normally purge after a few years.
