How Long Should I Keep My PPP Loan Records?
So your probably wondering how long you need to hold onto all the paperwork from your PPP loan, and the official SBA requirement is 6 years from when the loan was forgiven or repaid in full. But the PRACTICAL answer—based on the 10-year statute of limitations for criminal and civil enforcement—is that you should keep everything for AT LEAST 10 years, and arguably longer if your application had any issues. The 6-year requirement is what the SBA regulations say, but if federal investigators show up in year 8 or 9 asking questions about your 2020 PPP loan, you’ll wish you’d kept those records even though you weren’t technically required to.
We represent clients in PPP fraud investigations throughout California and the federal system, and we’ve seen cases where defendants threw away records after 6 years (thinking they’d satisfied the SBA requirement), only to face investigation in year 7 or 8 and have NO documentation to prove there application was legitimate. Prosecutors view the absence of records as evidence of fraud or obstruction, even if you destroyed them before any investigation started. The inability to produce documents you were supposed to maintain is a HUGE problem if your ever questioned about the loan, and it’s virtually impossible to reconstruct accurate records years after the fact.
The tension is between the SBA’s official 6-year retention requirement and the reality that investigations can continue for 10 years under the extended statute of limitations. Lenders were required (as of 2024) to keep PPP records for 10 years specifically to align with the statute of limitations. But borrowers’ obligations weren’t updated—the regulations still say 6 years. That creates a gap where borrowers might legally destroy records that could later be crucial to defending against fraud allegations. The conservative approach is to keep EVERYTHING for at least 10 years, regardless of what the regulations technically require.
What Does the SBA Require for Record Retention?
The SBA’s record retention requirements for PPP borrowers are set out in the loan forgiveness application and the SBA Form 3508 instructions. The requirements vary based on loan size:
For loans OVER $150,000: Borrowers must retain all supporting documentation for 6 years after the date the loan is forgiven or repaid in full. That includes all records submitted with the forgiveness application, plus documentation supporting the loan application itself. The 6-year period starts when forgiveness is GRANTED, not when you applied for forgiveness. So if your loan was forgiven in December 2021, the 6-year period runs until December 2027.
For loans of $150,000 OR LESS: The requirements are slightly different. You must retain employment records and payroll documentation for 4 years, and all other documentation for 3 years, measured from the date you SUBMITTED the forgiveness application to the SBA (not from when it was approved). So if you submitted your forgiveness application in October 2020, payroll records must be kept until October 2024, and other documents until October 2023.
The rationale for shorter retention periods for smaller loans was that there lower risk and less likely to be subject to detailed audits. But that rationale was developed before the massive scale of PPP fraud became clear and before the statute of limitations was extended to 10 years. The requirements haven’t been updated to reflect the current enforcement environment, which is why borrowers need to think beyond the minimum technical requirements.
What’s confusing is that LENDERS were subject to a 6-year retention requirement initially, but that was extended to 10 years in an August 2024 interim final rule specifically to align with the statute of limitations for fraud prosecutions. The SBA recognized that lenders need to maintain records for the full period they might be subject to investigation or enforcement. But the borrower retention requirements weren’t similarly extended, creating an inconsistency where lenders must keep records longer than borrowers—even though borrowers are the ones at risk of prosecution.
What Specific Records Do I Need to Keep?
The SBA requires borrowers to retain ALL documentation submitted with the loan application and forgiveness application, plus supporting records that verify the information in those applications. That’s a broad category, but here are the specific documents most borrowers need to keep:
Loan application documentation: The original PPP loan application (SBA Form 2483), including all schedules and certifications. Documentation showing your business was operating on February 15, 2020 (business licenses, invoices, bank statements from that period). Tax forms showing 2019 payroll or income—IRS Form 941 (quarterly payroll tax returns), Form 940 (annual unemployment tax return), Schedule C if self-employed, Form 1120 or 1120-S for corporations, Form 1065 for partnerships. Documentation of the number of employees and payroll costs used to calculate the loan amount. Any additional documents submitted to the lender during the application process.
Use of proceeds documentation: Bank statements for the account(s) where PPP funds were deposited and from which they were spent, covering the entire covered period (8 weeks or 24 weeks depending on when you got the loan). Payroll records showing payments to employees during the covered period—payroll registers, pay stubs, cancelled checks or ACH payment confirmations. Third-party payroll service reports if you used a payroll company like ADP, Paychex, or Gusto. Tax forms filed during and after the covered period—Form 941 for each quarter of the covered period, Forms W-2 and W-3 for employees, Form 1099-MISC or 1099-NEC for contractors. State quarterly wage reports and unemployment insurance filings.
Forgiveness application documentation: The forgiveness application itself (Form 3508, 3508EZ, or 3508S depending on your loan size). Documentation supporting your claimed expenses—payroll reports, rent/mortgage payments, utility bills. Certifications and calculations showing how you arrived at the forgiveness amount. Correspondence with your lender about the forgiveness process.
Other records: Any correspondence with the SBA, your lender, or loan servicer about the PPP loan. Documentation of changes to your business during 2020-2021 (if applicable)—closing a business, selling it, bankruptcy. Records showing how you calculated your employee count and payroll costs if there were any complexities (seasonal employees, tipped employees, forgiven obligations). Any amendments or corrections to your application or forgiveness documents.
The practical approach is: if a document relates in ANY way to your PPP loan—either supporting your eligibility, showing how you calculated the loan amount, or documenting how you spent the money—keep it. Don’t try to decide “this document probably isn’t necessary.” Just keep everything. Storage is cheap (whether physical files or digital scans), and missing documents during an investigation is expensive.
What Happens If I Destroyed Records After 6 Years?
If you destroyed records after the 6-year SBA retention period expired but before the 10-year criminal statute of limitations ran, you’ve created a serious problem for yourself if your investigated. Legally, you complied with the SBA requirement—you kept records for the mandated period. But practically, you can’t defend yourself against fraud allegations without documentation, and prosecutors will argue that destruction of records (even if technically permitted) shows consciousness of guilt.
Here’s the scenario. You got a PPP loan in May 2020, it was forgiven in November 2020. You kept all records through November 2026 (6 years from forgiveness). In January 2027, you shredded everything because you met the retention requirement. In March 2028, FBI agents show up asking about your PPP loan. They’ve identified discrepancies between what you claimed on the application and what your tax returns show. You can’t produce the documents because you destroyed them.
What happens? First, prosecutors will argue the destruction was evidence of guilt—”if the application was legitimate, why get rid of the records?” You’ll respond “I followed the SBA rules,” but that doesn’t change the optics. Second, you have NO way to prove your case. If the government alleges you inflated payroll, and you don’t have payroll records to show what you actually paid, you can’t defend yourself. If they allege your business wasn’t operating in February 2020, and you don’t have invoices or bank statements from that period, you can’t prove it was. The burden of proof is on the government, but the practical burden shifts to you if you can’t produce exculpatory documents.
Third, there’s a potential obstruction of justice issue. Under 18 U.S.C. § 1519, it’s a crime to destroy documents with intent to obstruct a federal investigation. If prosecutors can show you KNEW you were under investigation when you destroyed records, that’s obstruction—even if the investigation hadn’t been disclosed to you yet. This is a hard charge to prove (they need to show you had knowledge of the investigation), but it’s a risk if you destroy records around the time investigative activity is occurring.
The safer approach: keep records for the full 10-year statute of limitations period at minimum. If you got a PPP loan in 2020, keep records through 2030. If it was 2021, keep them through 2031. After the statute has run, the risk of prosecution disappears and you can safely destroy records. But destroying them earlier—even after meeting the technical SBA requirement—is a gamble that might not pay off.
Can the SBA or Investigators Force Me to Produce Records?
Yes, if your under investigation or audit, the SBA and federal law enforcement have broad authority to compel production of records. The SBA Office of Inspector General can issue administrative subpoenas requiring you to produce documents. Federal prosecutors can issue grand jury subpoenas. FBI agents can execute search warrants. In all those scenarios, you’re required to produce records or face consequences for non-compliance.
If you still have the records, you produce them (after consulting with an attorney about privilege issues and how to respond). If you DESTROYED the records after the retention period expired, you’re in a difficult position. You can’t produce what you don’t have. Prosecutors will view that skeptically, but you haven’t violated the law by destroying records you weren’t required to keep (assuming there was no investigation pending at the time).
But if you destroyed records AFTER receiving a subpoena, or after learning you were under investigation, that’s obstruction of justice—a separate federal crime with up to 20 years in prison under § 1519. Even destroying records BEFORE a formal subpoena but after you have reason to believe an investigation is underway can be obstruction if prosecutors prove you did it to impede the investigation. So if you get contacted by the SBA OIG or FBI, DO NOT destroy any records from that point forward, even if the retention period has passed.
The other issue is spoliation of evidence in civil cases. If the government sues you under the False Claims Act for PPP fraud, and you can’t produce records that would be relevant to your defense because you destroyed them, the court can impose sanctions—including an adverse inference instruction to the jury (telling them to assume the missing documents would have been unfavorable to you). That can be outcome-determinative in close cases.
Should I Keep Records Longer Than 10 Years?
For most borrowers, 10 years is sufficient—that’s the criminal statute of limitations, and after it expires, you can’t be prosecuted. But there are situations where keeping records longer makes sense:
If your application had any irregularities. If you had concerns about whether your business was eligible, whether your payroll calculation was correct, whether you spent the money appropriately—keep records indefinitely. The peace of mind is worth the minimal cost of storage. If your application was straightforward and you’re confident it was legitimate, 10 years is probably fine. But if there were gray areas, keep the documentation as long as possible.
If you were part of a larger scheme or worked with a loan preparer. If a loan preparer helped you with your application, or if you were involved in any way with others who committed fraud, keep records longer. Conspiracy cases and large-scale fraud investigations can take many years to develop, and you might be contacted as a witness or co-defendant long after you thought the matter was closed. Having contemporaneous records showing what you knew and what you did is crucial for defending yourself.
If there are ongoing business or tax implications. If the PPP loan relates to tax issues that might be audited, or business disputes that might result in litigation, keep records as long as those issues could arise. An IRS audit of your 2020 business tax return could happen years later, and the PPP loan might be relevant. A lawsuit with a business partner about how PPP funds were used could come up years after the loan. Keep records as long as any related matter could potentially arise.
If you have restitution obligations or civil settlements. If you entered into a settlement agreement with the SBA or a civil compromise about your PPP loan, keep records related to that agreement indefinitely. Settlement agreements can require ongoing compliance, reporting, or payment obligations that extend beyond the statute of limitations, and you’ll need documentation to prove compliance.
The general principle: documents are cheap to keep (whether in a file cabinet or scanned and stored digitally), and missing documents during an investigation or lawsuit can be catastrophic. When in doubt, keep them. You can always destroy them later if it becomes clear there’s no risk, but you can’t recreate them if they become necessary.
What If I Lost Records or Never Had Them?
Some borrowers never had proper documentation to begin with—they filed PPP applications based on estimates or rough calculations, didn’t maintain payroll records, or didn’t keep invoices and receipts. Others lost records due to business closures, computer failures, natural disasters, or just poor record-keeping. If your investigated and don’t have records, you face serious challenges defending yourself.
The first step is to RECONSTRUCT what you can from other sources. Bank statements can be obtained from your bank (usually going back 7 years). Tax returns can be obtained from the IRS using Form 4506 or 4506-T. State agencies have records of payroll tax filings and unemployment insurance reports. Third-party payroll companies maintain records of payroll processing. Credit card statements can show business expenses. Vendors and customers might have copies of invoices.
Reconstructed records are better than nothing, but there MUCH weaker than contemporaneous documentation. Prosecutors are skeptical of records that are “recreated” years after the fact—they assume your creating documents that support your story rather than producing objective evidence of what actually happened. If you tell investigators “I spent the PPP money on payroll” but you can’t produce payroll records and instead provide a spreadsheet you created last week showing estimated payroll, that’s not going to be convincing.
If you genuinely lost records (fire destroyed your office, computer crashed and backups failed, business closed abruptly and records were thrown away), document HOW and WHEN they were lost. If there’s a police report about the fire, an insurance claim, contemporaneous emails or texts mentioning the computer crash—preserve that evidence. It shows the loss was inadvertent rather than intentional destruction to hide fraud. It doesn’t SOLVE the problem of missing records, but it at least explains why they’re missing.
If you never HAD proper records because the application was fraudulent, there’s nothing to reconstruct and your in serious trouble if investigated. You can’t produce payroll records for employees who didn’t exist. You can’t produce rent receipts for a business that was never operating. The absence of documentation is itself strong evidence of fraud in those situations, and there’s no good way to explain it.
Can I Get in Trouble for NOT Keeping Records?
Failure to maintain records as required by the SBA can result in several consequences. First, if the SBA audits your loan and you can’t produce required documentation, they can deny forgiveness (if it hasn’t been granted yet) or revoke forgiveness and demand repayment of the loan. The inability to document your use of funds means you can’t prove you met the requirements for forgiveness, so the loan becomes due as if forgiveness was never granted.
Second, failure to maintain records can be evidence of fraud in criminal cases. While it’s not a separate CRIME to fail to keep business records (absent specific record-keeping requirements for regulated industries), prosecutors argue that the absence of records shows the defendant knew the application was fraudulent and didn’t keep records because there was nothing to document. “If your business was legitimate and you paid employees as you claimed, you’d have payroll records—the fact that you don’t have them shows you never paid those employees.”
Third, in False Claims Act civil cases, the inability to produce records can result in adverse inferences, evidentiary sanctions, or judgment against you. Courts expect parties to preserve documents relevant to litigation, and if you can’t produce them, the court might instruct the jury to assume the documents would have hurt your case. That shifts the effective burden of proof and makes it much harder to defend.
Fourth, destroying records AFTER an investigation starts is obstruction of justice, which carries up to 20 years in prison under § 1519. Even if the destruction was otherwise lawful (the retention period had passed), doing it with intent to obstruct an investigation is a crime. And prosecutors don’t need to prove you KNEW about a formal investigation—if you had reason to believe your conduct might be scrutinized, destroying records can be obstruction.
The lesson: maintain records for at least as long as the SBA requires, and realistically for as long as the statute of limitations runs. The consequences of NOT having records when you need them far outweigh the minor inconvenience and cost of keeping them.
Should I Keep Digital or Physical Records?
Either format is acceptable, but you need to ensure the records are READABLE and AUTHENTIC. The SBA doesn’t require physical paper copies—scanned documents stored digitally are fine, as long as there clear and complete. But you need to have a system that ensures the digital files won’t be lost, corrupted, or become inaccessible due to technology changes.
practices for digital record retention:
Scan physical documents to PDF. Use a scanner or phone app to create PDF copies of all paper documents—loan applications, forgiveness applications, payroll records, bank statements, tax returns. PDFs are more stable and universally readable than proprietary formats. Name files descriptively (e.g., “PPP_Application_5-15-2020.pdf” rather than “Document1.pdf”).
Store files in multiple locations. Don’t rely on a single hard drive or computer. Use cloud storage (Google Drive, Dropbox, OneDrive) as a backup, plus an external hard drive or USB drive stored separately. If one system fails, you have redundant copies. Cloud storage has the advantage of being accessible from anywhere and typically has good long-term reliability.
Organize files logically. Create folders for different categories—Loan Application, Payroll Records, Forgiveness Application, Tax Documents, Bank Statements. Within each folder, organize chronologically or by type. You want to be able to find specific documents quickly if investigators request them or if you need them for your defense.
Test periodically that files are readable. Every year or two, open some of the files to make sure they’re not corrupted and that you still have software that can read them. Technology changes—file formats become obsolete, operating systems change. If you stored documents in a proprietary format from accounting software you no longer use, you might not be able to open them in 10 years. PDFs are safer for long-term storage.
Keep a list of what you have. Maintain an inventory of all the records you’re keeping, with descriptions and file locations. If investigators ask for “all documents related to your PPP loan,” you want to be able to quickly identify what you have and where it is. The list also serves as a check—if a file gets accidentally deleted, you’ll know it’s missing when you review the inventory.
Physical records have the advantage that there’s no risk of technology failure—a paper document will still be readable in 50 years. But they require physical storage space, can be destroyed by fire or water damage, and can degrade over time. Digital records are easier to store and search, but require redundancy and attention to ensure there accessible long-term. Many borrowers keep both—physical originals plus scanned digital copies—for maximum protection.
What If I’m Selling My Business or Closing It?
If your selling your business, you need to ensure PPP records are preserved and transferred appropriately. The buyer typically inherits any liabilities related to the business, including potential issues with PPP loans if they purchase assets and assume liabilities. Make sure the purchase agreement addresses who retains custody of PPP records and who’s responsible for responding to any future audits or investigations. Even if the buyer takes over the business, YOU might still be personally liable if there was fraud in the application (particularly if you personally signed certifications), so keep your own copies of all records.
If your closing the business, the PPP record retention obligation doesn’t disappear just because the business no longer exists. You’re still required to maintain records for the full retention period. If the business was a corporation or LLC and you dissolve it, make sure someone (usually the former owner or a principal) retains custody of the PPP records and knows where they are. We’ve seen cases where businesses closed, records were thrown away or lost, and years later the former owners faced investigation and couldn’t produce anything because “the business doesn’t exist anymore.” That’s not a defense—the retention obligation continues even after dissolution.
If the business went through bankruptcy, the bankruptcy trustee might have taken custody of records. Make sure you know where the records ended up and that you can access them if needed. Get copies before the bankruptcy case closes if possible. The trustee’s obligation to maintain records might end when the case closes, and you don’t want to be in a situation where records were destroyed as part of the bankruptcy process and you have no copies.
When Can I Safely Destroy PPP Records?
The safest answer: after the 10-year statute of limitations expires AND you’ve received no indication of any investigation. If your PPP loan was obtained in June 2020, the statute runs to June 2030. After July 2030, if you haven’t been indicted, contacted by investigators, received a grand jury subpoena, or had any indication of civil proceedings, the risk of prosecution is essentially zero and you can safely destroy records.
But even then, consider whether there are OTHER reasons to keep them. If there are ongoing tax issues, business disputes, or restitution obligations, keep the records longer. If you just want peace of mind, keep them indefinitely—storage costs are minimal. But purely from a criminal prosecution risk standpoint, once the statute has expired without any action, your exposure ends.
If you DO decide to destroy records, document WHEN and HOW they were destroyed. Keep a log showing “On August 15, 2030, I shredded all PPP loan records from 2020 loan, as the 10-year statute had expired.” If anyone ever asks why you don’t have the records, you can show they were destroyed AFTER the retention period and statute of limitations had run, not during a pending investigation. This documentation protects against later allegations that you destroyed records to obstruct justice.
And one final point: if you have ANY concern that your PPP application might have contained false information, or if you’ve heard that others in similar situations are being investigated, DO NOT destroy records even after the statute has run. Keep them indefinitely. The cost of storage is negligible compared to the value of having documentation if you ever need to defend yourself, and there’s no downside to keeping them longer than required.
If your concerned about PPP record retention requirements, or if your under investigation and don’t have complete records, talk to a federal criminal defense attorney who has experience with these cases. We represent clients in PPP fraud investigations throughout California and the federal system, and we can advise on what records you need to preserve, how to respond if the SBA or investigators request documents, and how to defend against allegations of fraud when documentation is incomplete. The record retention requirements might seem bureaucratic, but they’re critical to protecting yourself against prosecution for years to come. Call us for a consultation.