If you took out a Paycheck Protection Program loan back in 2020, you probably assumed that chapter of your business's history closed years ago. The loan was forgiven, the paperwork went in a drawer, and you moved on. But 2026 is turning out to be the year that assumption gets tested. The Department of Justice is running one of its most active stretches of PPP-related False Claims Act enforcement since the program ended, and this time the cases aren't being built by federal investigators combing through files by hand. They're being built by algorithms.
Why 2020 Loans Are Suddenly Back in the News
The False Claims Act carries a six-year statute of limitations, and for most PPP loans originated in the early rounds of 2020, that window starts closing in April and May of 2026. Anyone who wanted to file a claim tied to an original loan application effectively has a closing door in front of them right now, and that deadline pressure has produced exactly the effect you'd expect: a surge in filings.
The Department of Justice's Civil Division reported that whistleblowers filed 1,297 qui tam actions in fiscal year 2025 alone, following 980 in fiscal year 2024, with pandemic-era relief programs making up a meaningful share of that volume. FCA settlements and judgments hit $6.8 billion in FY2025, the highest annual recovery total in the statute's history. Some of that six-year clock can stretch further than borrowers expect, too. A loan's forgiveness application, filed later than the original loan, can extend the window depending on what representations were made in it, and a whistleblower filing a case under seal tolls the deadline the moment it's filed, regardless of when it becomes public. In other words, "the loan was six years ago" doesn't automatically mean you're in the clear.
The Case-Sourcing Has Changed, and That's the Real Story
Here's what makes this enforcement wave different from anything that came before it. When the SBA published its PPP loan recipient database, it was framed as a transparency measure, letting the public see who got money and how much. What it's become is raw material for a new kind of whistleblower.
Plaintiffs' attorneys and professional relators are now running AI-driven data mining tools directly against that public database, cross-referencing loan amounts and borrower names against corporate filings, state business registries, news coverage, and other public records to flag inconsistencies at scale. A recruiter no longer has to stumble onto a tip from a disgruntled employee to build a case. The software does the first pass, and a viable-looking mismatch becomes a sealed complaint.
The single most common theory driving these cases is the affiliation rule. PPP eligibility caps borrowers at 500 employees for first-draw loans and 300 for second-draw loans, but those counts aren't limited to your own payroll. Under SBA affiliation rules, employees of related or commonly controlled entities can get added into that headcount. A business that looked comfortably under the threshold looking only at its own W-2s can turn out to have been over the line once a parent company, sister entity, or common ownership structure gets factored in. Because affiliation relationships are often discoverable through public corporate records, they're exactly the kind of pattern automated tools are built to find.
The Department of Justice has leaned into this shift rather than treating it as a nuisance. Its Civil Division recently launched what it's calling the FOCUS initiative — Fraud Oversight through Careful Use of Statistics — a program explicitly designed to formalize how DOJ works with data-mining relators and their statistical case theories. That's a signal worth sitting with: the government isn't just tolerating algorithmically sourced whistleblower cases, it's building institutional infrastructure to process more of them.
What the Settlements Actually Look Like
These aren't abstract legal theories playing out only against Fortune 500 companies. Early 2026 settlement announcements give a concrete sense of scale and who's getting swept in:
- Akris, Inc. paid over $1.8 million to resolve allegations tied to miscounting affiliate employees on its PPP application.
- Alupress LLC paid $2.2 million over a similar employee-count failure.
- The Harvard Club of Boston settled for $2.4 million after questions about a private club's eligibility for the program in the first place.
- Semblex Corporation paid just over $3 million tied to corporate ineligibility findings.
- A cluster of nonprofit borrowers settled a combined $3 million-plus over separate nonprofit eligibility issues.
None of these are household names, and that's the point. This isn't limited to businesses making headlines already — it's mid-sized operating companies, private clubs, manufacturers, and nonprofits, the same kind of entities that make up most of the PPP borrower pool. If your business took a loan in the $150,000-and-up range and had any kind of affiliated entity, shared ownership, or corporate family structure at the time, you're squarely inside the profile these tools are built to flag.
The Record-Retention Gap Almost Nobody Talks About
This is where the story gets genuinely useful for planning, not just alarming. Most PPP borrower guidance you'll find still cites the original SBA rule: keep your records for six years after the loan is forgiven or repaid in full for loans over $150,000, or three to four years if you used the simplified Form 3508S for smaller loans. Plenty of businesses, following that guidance to the letter, have already cleaned out the file cabinet.
But that six-year figure predates a change that matters a lot more than most borrowers realize. In August 2022, Congress passed the PPP and Bank Fraud Enforcement Harmonization Act, which extended the criminal statute of limitations for PPP fraud from the original five-to-six-year range out to ten years. Two years later, in August 2024, the SBA followed up with an interim final rule extending lenders' own record retention requirement to ten years as well, explicitly to keep pace with that longer exposure window.
The result is a real gap between "what SBA guidance technically tells borrowers to keep" and "how long the government's actual fraud exposure window can run." If you shredded your PPP file at the six-year mark and a question comes up in year seven, eight, or nine, you may find yourself trying to reconstruct payroll calculations, affiliation determinations, and fund-usage records from memory, against a well-resourced opposing party with an algorithm and a public database on its side.
What to Actually Do About This
You don't need to panic over a loan that was properly obtained and properly used. But if you received a PPP loan in 2020, especially one north of $150,000, or if your business had any affiliated entities, common ownership, or a parent/subsidiary relationship at the time, a few concrete steps are worth taking now rather than after a demand letter shows up:
-
Reconstruct the file, don't rely on memory. Pull together the original loan application, all payroll documentation used to support it, correspondence with your lender, and the forgiveness application and its supporting materials. If any of it lives only in an old accountant's inbox or a decommissioned system, get it into your own hands now.
-
Stress-test your eligibility math today, not in 2020's rules alone. Revisit the affiliation and size calculations with fresh eyes. If your business had any related entities at the time — common ownership, shared management, franchise relationships — walk through whether those employees should have been counted, and document your reasoning either way.
-
Trace where the money actually went. Confirm your records show the funds were spent on eligible payroll and operating costs within the required timeframe, and that this ties out to your forgiveness submission.
-
Keep everything for ten years, not six. Given the gap between the borrower guidance and the actual fraud statute of limitations, the safer retention period is ten years from loan origination or forgiveness, not six.
-
Talk to counsel before a Civil Investigative Demand arrives, not after. If your internal review turns up a genuine issue, there's real value in raising it proactively — including the option of voluntary repayment to the SBA — rather than waiting for DOJ or a relator to find it first.
Why This Is Really a Recordkeeping Story
Strip away the legal theory and what's left is a lesson about financial records generally: the businesses in the best position right now are the ones that can actually produce a clean, complete, time-stamped trail of what they did and when, without having to reconstruct it from scattered emails and a bank's online portal that only keeps two years of statements.
That's the deeper argument for treating your books as a permanent, auditable record rather than a seasonal chore you clean up for tax time and then archive somewhere you'll never look again. Plain-text accounting systems, where every transaction lives in a version-controlled, human-readable file, make this kind of multi-year lookback dramatically easier. You're not hoping a login still works or a PDF didn't get lost in a migration — the full history is just there, greppable, diffable, and exactly as it was recorded the day you made the entry.
Keep Records That Can Actually Defend You
A decade-long exposure window on decisions you made in 2020 is a strong argument for financial records that don't quietly decay or disappear. Beancount.io offers plain-text accounting that gives you full transparency and a permanent, version-controlled history of every transaction — no proprietary format, no vendor lock-in, and no scrambling to reconstruct a payroll calculation from six years ago. Get started for free and build a bookkeeping system that holds up under scrutiny, whenever that scrutiny arrives.