The PPP enforcement landscape has shifted significantly, with increased scrutiny from federal regulators and a growing focus on civil and criminal liability. The key developments and takeaways are outlined below: 

• DOJ enforcement has shifted PPP compliance risk from administrative review to civil and criminal exposure.
• Lenders and borrowers may face False Claims Act liability for eligibility errors, payroll miscalculations, or inaccurate certifications.
• The statute of limitations for PPP-related fraud has been extended to 10 years, increasing long-term exposure.
• Recent enforcement actions signal a willingness to pursue claims against both borrowers and lenders.
• Proactive portfolio review, documentation, and compliance assessments are critical to mitigate risk

Introduction

PPP enforcement is no longer primarily an administrative matter. Increasingly, the U.S. Department of Justice ("DOJ") has taken the lead in policing Paycheck Protection Program ("PPP") compliance, bringing civil actions under the False Claims Act ("FCA") and, in a growing number of cases, criminal prosecutions against borrowers, lenders, and intermediaries alike. This marks a significant escalation from earlier phases of PPP enforcement, which centered first on borrower-on-lender litigation in state courts and then on administrative reviews by the Small Business Administration ("SBA").

The PPP was created by the Coronavirus Aid, Relief, and Economic Security Act ("CARES Act") in 2020, authorizing hundreds of billions of dollars in forgivable loans to small businesses during the COVID-19 pandemic. The program was designed for speed; lenders were permitted to rely on borrower certifications and process loans on a compressed timeline. The program succeeded in sustaining businesses through an unprecedented crisis. But speed came at a cost: the resulting compliance gaps are now the foundation for a growing number of DOJ enforcement actions.

The CARES Act Does Not Provide Complete Immunity to Lenders

The CARES Act and SBA regulations permitted lenders to rely on borrower certifications and supporting documentation when originating PPP loans, provided that lenders conducted a good-faith review of borrower calculations and documentation. These provisions were intended to allow lenders to process loans quickly during the early months of the pandemic. However, they do not provide blanket immunity for lenders that fail to comply with PPP program requirements or ignore obvious red flags.

Recent enforcement actions demonstrate that lenders and intermediaries may face FCA exposure where they:

• Approve loans for ineligible borrowers;
• Miscalculate payroll costs;
• Fail to implement adequate fraud-prevention controls; or
• Submit inaccurate certifications to the SBA.

Extension of the PPP Fraud Statute of Limitations

Congress enacted the PPP and Bank Fraud Enforcement Harmonization Act of 2022 in August of that year, extending the statute of limitations to ten years for criminal charges and civil enforcement actions alleging fraud by borrowers in connection with PPP loans. Prior to this amendment, many federal fraud offenses were subject to the general five-year statute of limitations under 18 U.S.C. § 3282. The extended limitations period means that PPP-related investigations and prosecutions may continue for the remainder of the decade. As a result, lenders and borrowers should retain relevant PPP documentation for the full duration of the limitations period.

False Claims Act Enforcement

The False Claims Act remains the federal government's principal civil enforcement tool in PPP investigations. The statute imposes liability on any person who knowingly submits a false or fraudulent claim for payment to the federal government. In the PPP context, FCA liability may arise where a borrower, lender, or intermediary:

• Knowingly misrepresents eligibility for PPP funds;
• Inflates payroll costs to obtain larger loans;
• Submits inaccurate certifications in connection with loan forgiveness; or
• Seeks payment of government guarantees based on noncompliant loans.

Many FCA cases originate as qui tam actions filed by whistleblowers, who may receive a share of any recovery obtained by the government.

Criminal Enforcement of Pandemic-Relief Fraud

Criminal prosecutions involving PPP fraud have also become widespread. The DOJ regularly reports criminal cases involving pandemic-relief fraud schemes. These cases commonly involve:

• Fictitious businesses;
• Inflated payroll records;
• Identity theft used in loan applications; and
• Diversion of PPP loan proceeds for personal use.

Pandemic-relief fraud enforcement remains a significant federal enforcement priority.

Representative Enforcement Actions

Lender Liability: United States v. Kabbage, Inc.

In May 2024, the Department of Justice announced a significant settlement resolving allegations that fintech lender Kabbage, Inc. (which serviced PPP loans under the name KServicing) violated the False Claims Act by submitting false claims for PPP loan guarantees, forgiveness payments, and processing fees to the Small Business Administration. According to the government, Kabbage approved numerous PPP loans that improperly calculated payroll costs and lacked adequate safeguards designed to detect fraudulent applications. The resolution established a government claim of up to $120 million in KServicing's bankruptcy proceedings. The matter underscores the government's willingness to pursue FCA claims not only against borrowers but also against lenders and intermediaries involved in the loan origination and forgiveness process.

Borrower Eligibility and Affiliation Rules: Victory Automotive Group

In October 2023, Victory Automotive Group, Inc. agreed to pay $9 million to resolve False Claims Act allegations that it knowingly submitted false information in connection with its PPP loan application and subsequent forgiveness request. The government alleged that Victory Automotive falsely certified that it qualified as a small business with fewer than 500 employees. In reality, according to the government, the company shared common operational control with dozens of automobile dealerships and therefore exceeded the SBA's employee-based eligibility thresholds under the program's affiliation rules.

Criminal Prosecutions: United States v. Staveley

One of the earliest criminal PPP fraud prosecutions involved United States v. Staveley, in which the defendant attempted to obtain PPP loans for businesses that were no longer operating or which he did not own, using falsified tax documentation.

Civil FCA Settlements Involving PPP Borrowers

In November 2025, the Department of Justice announced that several transportation companies agreed to pay approximately $4.4 million to resolve allegations that they improperly obtained PPP loans by misrepresenting their eligibility and the number of employees associated with their operations. In January 2026, four nonprofit organizations agreed to pay more than $3 million to resolve False Claims Act allegations that they improperly obtained PPP loans for which they were not eligible under program rules.

Practical Implications for PPP Lenders and Borrowers

Borrowers and lenders should take concrete steps now to evaluate and mitigate PPP-related enforcement risk.

Portfolio Review

Conduct retrospective reviews of PPP loan portfolios to identify compliance issues. Key areas of focus include:

• Payroll cost calculations: Confirm that loan amounts reflected only eligible payroll costs and excluded capped or ineligible compensation;
• Borrower eligibility: Verify compliance with SBA size standards at the time of application, including affiliation rules for commonly owned or controlled entities;
• Documentation completeness: Ensure loan files contain adequate support for borrower certifications, including payroll records, tax filings, and organizational documents; and
• Red flag identification: Flag loans exhibiting indicia of fraud — newly formed entities, inconsistent payroll data, or missing documentation — for further review.

Forgiveness Certifications

Verify that certifications submitted to the SBA for loan forgiveness were accurate and adequately documented. Key steps include:

• Eligible expenses: Confirm that forgiveness applications reflected only eligible payroll costs, rent, utilities, and other covered expenses;
• Employee and FTE calculations: Verify that employee counts and full-time equivalent levels were calculated using SBA-approved methodologies, including applicable affiliation rules; and 
• Certification accuracy: Assess whether lender certifications to the SBA accurately represented the lender's review of borrower submissions.

Whistleblower Risk

Because many FCA investigations originate as qui tam (whistleblower) lawsuits, proactive internal review is critical.

• Internal compliance audits: Conduct privileged reviews to identify loans or certifications presenting enforcement risk.
• Voluntary disclosure considerations: Where significant issues are identified, evaluate whether voluntary government disclosure may mitigate potential liability.

Document Retention

Given the extended statute of limitations for PPP-related fraud, borrowers and lenders should retain all relevant PPP documentation for at least ten years from the date of loan origination or forgiveness, whichever is later. Key documents to retain include:

• Loan applications and borrower certifications;
• Payroll records and tax documentation submitted by borrowers;
• Forgiveness applications and supporting documentation;
• Internal underwriting memoranda and compliance reviews; and
• Communications with the SBA regarding loan guarantees, forgiveness, and processing fees.

Cooperation and Response Protocols

Establish clear protocols for responding to government inquiries, civil investigative demands, and subpoenas, including designating response coordinators, engaging outside counsel where appropriate, and enforcing document preservation obligations.

Conclusion

The shift from SBA administrative reviews to DOJ civil and criminal enforcement represents a qualitative change in risk for PPP program participants. Borrowers and lenders that have not yet evaluated their PPP portfolios for potential compliance issues should treat the current enforcement environment (and the extended statute of limitations that sustains it) as a reason to act now rather than later.

To learn more about our Finance practice, click here.