PPP Fraud Statute of Limitations: What Changed in 2022?
So your probably wondering what happened in 2022 that suddenly gave prosecutors more time to investigate and charge PPP fraud cases, and the answer is Congress passed two laws extending the statute of limitations from 5 years to 10 years. On August 5, 2022, President Biden signed the PPP and Bank Fraud Enforcement Harmonization Act and the COVID-19 EIDL Fraud Statute of Limitations Act, both with bipartisan support. These laws fundamentally changed the timeline for PPP and EIDL fraud enforcement, extending the window for criminal and civil prosecution from 2025-2026 (when most 5-year statutes would have expired) to 2030-2032 (when the new 10-year statutes expire).
We represent clients in PPP fraud investigations throughout California and the federal system, and the 2022 statute extension is probably the single most important legal development affecting our clients’ cases. Before August 2022, defendants who committed fraud in 2020 could reasonably expect that if they made it to 2025 without being charged, there risk would end. After August 2022, that timeline DOUBLED—the same defendants now face exposure until 2030. The extension gave prosecutors five additional years to investigate complex cases, gather evidence, coordinate with multiple agencies, and bring charges.
The laws apply RETROACTIVELY, meaning they extend the statute for offenses that occurred BEFORE the laws were passed. If you committed PPP fraud in April 2020, you originally had exposure until April 2025 under the 5-year statute. The 2022 law extended that to April 2030—five more years were added to cases that were already being investigated. Some defendants argued this violated constitutional protections against ex post facto laws, but courts have consistently upheld statute of limitations extensions as long as the original period hadn’t expired yet when the extension was passed. Since no 5-year statutes had run by August 2022 (the earliest PPP loans were in April 2020), the extension is constitutional.
What Were the Two Laws Passed in 2022?
The first law, H.R. 7352, the PPP and Bank Fraud Enforcement Harmonization Act of 2022, extended the statute of limitations for PPP fraud to 10 years. It amended Section 7(a) of the Small Business Act to provide that “notwithstanding any other provision of law, any criminal charge or civil enforcement action alleging that a borrower engaged in fraud with respect to a covered loan shall be filed not later than 10 years after the offense was committed.” The statute applies to both First Draw PPP loans and Second Draw PPP loans, covering the entire PPP program.
The second law, H.R. 7334, the COVID-19 EIDL Fraud Statute of Limitations Act of 2022, did the same thing for EIDL loans. It established a 10-year statute of limitations for criminal charges and civil enforcement actions related to EIDL fraud. Before this law, EIDL fraud was typically charged as wire fraud or false statements, which had 5-year statutes. The extension gave prosecutors the same 10-year window for EIDL fraud that bank fraud (which already had a 10-year statute) provided for PPP fraud.
Both laws were passed by Congress with bipartisan support—this wasn’t a partisan issue. Republicans and Democrats alike were angry about the scale of pandemic fraud and wanted to give law enforcement more time to investigate. The laws sailed through both houses with minimal opposition and were signed by President Biden on the same day. The legislative history emphasizes that the extension was necessary because PPP and EIDL fraud cases are complex, involve multiple defendants, require extensive financial analysis, and take years to develop—the original 5-year statute wasn’t enough time.
Why Did Congress Extend the Statute of Limitations?
The extension was a response to the MASSIVE scale of PPP and EIDL fraud and the recognition that 5 years wasn’t enough time to investigate and prosecute the most serious cases. The SBA Office of Inspector General estimated that $64 billion to over $200 billion in PPP and EIDL funds went to potentially fraudulent applicants. That’s billions with a B—an unprecedented level of fraud against a federal program. Federal investigators were overwhelmed with suspicious applications, and prosecuting even a fraction of them would take years.
Complex fraud cases take TIME. Here’s the typical timeline: fraud occurs in 2020, SBA identifies suspicious activity in 2021, case gets assigned to an investigator in 2022, evidence is gathered through 2023, case is presented to prosecutors in 2024, grand jury returns indictment in 2025. That’s five years just to GET to indictment, with no time for trial, appeals, or delays. If the statute was only 5 years from the date of the offense, prosecutors would be racing against deadlines and potentially losing cases because they couldn’t complete investigations in time.
The “harmonization” aspect of the PPP law addressed an inconsistency. Bank fraud (the charge used for most PPP fraud involving traditional banks) already had a 10-year statute of limitations under 18 U.S.C. § 3293. But PPP loans made by FINTECHS or non-bank lenders couldn’t be charged as bank fraud—they had to be charged as wire fraud, which had a 5-year statute under 18 U.S.C. § 3282. So defendants who got PPP loans from Chase or Wells Fargo faced 10-year exposure, while defendants who got loans from fintech lenders faced 5-year exposure. Congress decided that was unfair and arbitrary—fraud is fraud, and the statute should be the same regardless of which lender processed the application.
For EIDL loans, which were made directly by the SBA (not banks), prosecutors could only charge wire fraud or false statements—both 5-year statutes. The EIDL extension brought those cases in line with PPP bank fraud cases, giving all pandemic loan fraud a uniform 10-year limitations period. The legislative intent was to remove technical distinctions that allowed some fraudsters to escape prosecution based on which lender they used or which program they defrauded.
Does the 10-Year Statute Apply Retroactively?
Yes, the 2022 laws apply retroactively to fraud that occurred BEFORE the laws were passed. If you committed PPP fraud in April 2020, you originally had exposure until April 2025 (5 years). The August 2022 law extended that to April 2030 (10 years), even though the fraud occurred two years BEFORE the law was passed. This retroactive application is constitutional as long as the original statute of limitations hadn’t already expired when the extension was enacted.
The Supreme Court addressed this issue in Stogner v. California, holding that a law extending an ALREADY EXPIRED statute of limitations violates the Constitution’s ex post facto clause. But laws extending statutes that HAVEN’T YET EXPIRED are constitutional. Since the 2022 PPP and EIDL laws were passed in August 2022, and the earliest PPP loans were in April 2020, the original 5-year statutes wouldn’t have expired until April 2025—almost three years after the extension was passed. So the extension was well within constitutional bounds.
Defendants have challenged the retroactive application in some cases, arguing it’s unfair to change the rules after the conduct occurred. Those challenges have failed. Courts have consistently held that as long as the original limitations period hasn’t run, Congress can extend it retroactively. The reasoning is that defendants don’t have a “vested right” in the expiration of the statute until it actually expires. If the government acts before the deadline, they can extend that deadline—it’s not ex post facto because you never had a constitutional protection against prosecution in the first place.
The practical effect: if you committed PPP fraud in 2020 thinking you had 5 years of exposure, the rules changed midstream. You NOW have 10 years of exposure, and that extension is legally valid. You can’t argue “I relied on the 5-year statute when I committed the fraud” because reliance on the statute of limitations isn’t a defense. The statute is a procedural limitation on when charges can be brought, not a substantive element of the crime, and procedural rules can be changed retroactively as long as certain constitutional limits are respected.
What About Cases That Were Already Being Investigated?
The extension applies to ALL PPP and EIDL fraud cases where the statute hadn’t expired as of August 2022, including cases that were already under investigation. So if prosecutors were investigating your case in 2021-2022 and planning to indict before the 5-year statute ran in 2025-2026, they now have until 2030-2031. This gave investigators breathing room to slow down, gather more evidence, develop stronger cases, and coordinate multi-defendant prosecutions without rushing to beat deadlines.
Some prosecutors had been operating under the bank fraud 10-year statute anyway (for PPP loans from banks), so the extension didn’t change their timeline. But for EIDL cases and PPP cases involving fintech lenders, the extension was huge. Investigators who were scrambling to complete cases before 2025 deadlines suddenly had five more years. Cases that might have been dropped as too complex or time-consuming to finish became viable again.
The extension also affected investigative priorities. Before August 2022, prosecutors were focusing on simple, high-dollar cases they could charge quickly before statutes ran. After the extension, they could take time to develop more complex cases—loan preparer schemes, conspiracy cases with multiple defendants, cases requiring extensive financial forensics. That’s why we’re seeing MORE sophisticated fraud prosecutions in 2024-2025 than we did in 2021-2022—investigators have time to build those cases now.
Did the Extension Change Civil Statute of Limitations Too?
Yes, the 2022 laws extended the statute of limitations for CIVIL enforcement as well as criminal prosecution. The False Claims Act already had a longer limitations period than criminal cases—the later of 6 years from the violation OR 3 years from when the government discovered the violation, but in no event more than 10 years. The PPP and EIDL extension laws made the 10-year period explicit for pandemic loan fraud, ensuring that civil and criminal statutes aligned.
This is important because the government can pursue both criminal AND civil liability for the same conduct. If you committed $200,000 in PPP fraud, prosecutors can charge you criminally with bank fraud or wire fraud (facing potential prison time), AND the government can sue you civilly under the False Claims Act seeking treble damages ($600,000) plus penalties. The extension to 10 years for both criminal and civil cases means defendants face parallel exposure for the full decade.
Civil cases are often EASIER for the government to win than criminal cases. The burden of proof is preponderance of the evidence (more likely than not) rather than beyond a reasonable doubt. There’s no right to a jury trial—judges decide FCA cases. And civil cases don’t require proving criminal intent—just that you made false statements and received money as a result. So even defendants who avoid criminal prosecution might face civil judgments for three times the fraud amount plus penalties up to $27,894 per false claim.
The civil extension is particularly significant for whistleblower cases. Under the False Claims Act’s qui tam provisions, private individuals can file lawsuits on behalf of the government and receive 15-30% of any recovery. The 3-year discovery rule means whistleblowers can file cases years after the fraud, as long as they’re within 3 years of when they learned about it and within 10 years of when it occurred. So a whistleblower who discovers PPP fraud in 2028 can file a case about fraud from 2020, and it’s timely under the discovery rule.
Can Congress Extend the Statute Again?
Theoretically, yes—Congress has the power to extend statutes of limitations again as long as the current 10-year period hasn’t expired. So in 2028 or 2029, Congress could pass another law extending PPP fraud statutes from 10 years to 15 years, and it would be constitutional (under the same reasoning that the 2022 extension was valid). But as a practical matter, another extension seems VERY unlikely.
First, the 2022 extension was controversial even though it passed with bipartisan support. Defense attorneys, civil liberties groups, and some lawmakers argued it was unfair to keep extending deadlines and that 10 years is already very generous. Another extension would face stronger opposition, particularly if it’s done close to when the 10-year statutes are about to expire (which would make it look like prosecutors are just trying to save cases they failed to charge in time).
Second, 10 years is LONG for a statute of limitations. Most federal offenses have 5-year statutes. Murder and terrorism have no statute of limitations, but those are the most serious crimes. Ten years for fraud is already at the high end of limitations periods, and it’s hard to argue that it’s not enough time. The legislative history of the 2022 extension emphasized that complex cases take years to investigate—but if you can’t complete an investigation in 10 years, at some point it’s a resource allocation problem, not a statute of limitations problem.
Third, the political dynamics that supported the 2022 extension might not exist for future extensions. In 2022, pandemic fraud was still a hot topic—billions stolen, public outrage, bipartisan anger about fraud during a national emergency. By 2028 or 2029, the pandemic will be ancient history, there will be other priorities, and it’ll be harder to generate support for keeping PPP fraud prosecutions going. The extension to 10 years was sold as giving investigators enough time to finish the job; another extension would be admitting they can’t finish even with 10 years, which undermines the argument.
What’s more likely than another extension is that prosecutors will use the FULL 10 years available and make sure to indict cases before the deadlines. We’ll probably see a surge of indictments in 2029-2030 as prosecutors rush to charge cases before the statutes expire for 2020 fraud. That’s what happened with financial fraud cases in other contexts where statutes were about to run—prosecutors obtained indictments with days to spare, sometimes with bare-bones charging documents that got fleshed out later in superseding indictments.
What Does This Mean for Defendants?
If you committed PPP or EIDL fraud between 2020-2022, the 2022 statute extension means your criminal exposure lasts until 2030-2032 (10 years from the offense), not 2025-2027 (5 years). That’s FIVE MORE YEARS during which prosecutors can investigate, gather evidence, and bring charges. The extension fundamentally changed the risk calculus for anyone involved in pandemic loan fraud.
Before the extension, defendants who made it to 2024-2025 without being charged could start breathing easier—the statute was about to run. After the extension, making it to 2024-2025 means you’re only HALFWAY through the exposure period. Prosecutors have five more years to build cases, and there’s no indication there slowing down. In fact, prosecution rates INCREASED in 2024-2025 compared to earlier years, as investigators finished working through the backlog and started charging complex multi-defendant cases.
The extension also affects settlement leverage. Before August 2022, defense attorneys could point to approaching statute deadlines as reason to negotiate quick resolutions—”if you want to charge my client, you need to decide soon or lose the case.” After the extension, that leverage disappeared. Prosecutors have YEARS to decide whether to charge, which means they can take their time, demand more cooperation, and be less willing to accept favorable plea deals. Why rush to offer probation when you have until 2030 to make a charging decision?
For defendants under investigation, the extension means you can’t just wait it out. The strategy of “keep a low profile, hope they don’t find me, run out the clock” went from a 5-year gamble to a 10-year gamble. And during those 10 years, investigators are getting BETTER at identifying fraud through data analytics, cross-referencing databases, and using AI to spot patterns in applications. Your chances of being caught INCREASE over time as investigative techniques improve, not decrease.
Does the Extension Affect Record Retention Requirements?
Not directly—the SBA’s record retention requirements for borrowers remain 6 years from forgiveness or repayment for loans over $150,000 (and less for smaller loans). But the extension creates a GAP between how long you’re REQUIRED to keep records (6 years) and how long you CAN BE PROSECUTED (10 years). That gap is problematic because if you destroy records after 6 years (satisfying the SBA requirement), you might not be able to defend yourself if investigated in year 7, 8, or 9.
In response to the statute extension, the SBA extended LENDER record retention requirements to 10 years in a 2024 interim final rule. But BORROWER requirements weren’t similarly updated—the regulations still say 6 years. This creates the weird situation where your lender has to keep records of your loan for 10 years, but you’re only required to keep them for 6 years, even though YOU’RE the one who might be prosecuted and YOU’RE the one who needs the records to defend against fraud allegations.
The practical advice: ignore the 6-year requirement and keep PPP/EIDL records for the full 10-year statute of limitations period. If you got a loan in 2020, keep records through 2030. If it was 2021, keep them through 2031. After the statute has run, the risk of prosecution disappears and you can safely destroy records. But destroying them earlier—even if you’ve satisfied the technical SBA requirement—is a gamble that might leave you defenseless if investigated.
Can States Prosecute PPP Fraud With Different Statutes?
The 2022 federal statute extension applies to FEDERAL prosecution and civil enforcement. State prosecutions under state fraud statutes have their own statutes of limitations that weren’t affected by the federal law. Some states have brought PPP fraud cases under state laws (typically theft by deception, forgery, or state false claims acts), and those cases are governed by state statutes that vary by jurisdiction.
Most state fraud statutes have limitations periods of 5-6 years, though some are longer. A few states toll (pause) the statute of limitations for fraud until the fraud is discovered, giving prosecutors more time. State cases are less common than federal cases for PPP fraud—the federal government has primary jurisdiction since PPP and EIDL are federal programs—but some states have prosecuted egregious cases, particularly where defendants defrauded state programs in addition to federal ones.
The practical effect is that defendants might face BOTH federal prosecution (with the 10-year statute) AND state prosecution (with whatever state statute applies) for the same conduct. Double jeopardy doesn’t prevent this because the federal government and state governments are separate sovereigns—you can be prosecuted in both systems for the same act. So even if the federal statute runs without charges, you might still face state prosecution if your state’s statute hasn’t expired.
That said, state prosecutions for PPP fraud are uncommon. Most states defer to federal authorities for pandemic loan fraud cases, and the 10-year federal statute gives prosecutors plenty of time. But if you committed fraud that violated both federal law (false statements to the SBA or a bank) and state law (submitting forged documents, making false certifications under state law), you could theoretically be prosecuted in both systems, each with its own statute of limitations.
What Should I Do If the Statute Is Approaching?
If the 10-year statute for your PPP fraud is approaching (say, within 1-2 years of expiring) and you haven’t been charged or contacted by investigators, your chances of avoiding prosecution increase as the deadline gets closer. But you’re not safe until the statute ACTUALLY expires. Prosecutors sometimes obtain sealed indictments right before the deadline, then unseal them later when they locate the defendant or when related cases are ready.
As the deadline approaches, evaluate whether you’ve seen any investigative activity. If you’ve received grand jury subpoenas, been interviewed by FBI agents, had search warrants executed, received target letters, or had any contact suggesting investigation, prosecutors are probably building toward charges and might indict shortly before the statute runs. If you’ve heard NOTHING and the deadline is 6-12 months away, the chances of prosecution are decreasing—but they don’t disappear entirely until the statute expires.
Don’t make the mistake of thinking “the statute is about to run, I should destroy evidence.” If you destroy records close to when the statute is expiring, that could be viewed as obstruction of justice if prosecutors later discover it. Even if the statute for the underlying fraud runs, you can be charged with obstruction (which has its own statute running from when the destruction occurred). Keep records through the statute expiration and for a reasonable period after (at least 1-2 years) to be safe.
If the statute expires without an indictment, your exposure for THAT offense ends. But remember: if you committed multiple fraudulent acts (initial application fraud + forgiveness fraud, or multiple PPP/EIDL loans), each has its own 10-year statute. The expiration of one doesn’t eliminate liability for others. And civil liability under the False Claims Act might extend beyond criminal liability if the discovery rule applies.
The bottom line: the 2022 statute extension fundamentally changed the timeline for PPP and EIDL fraud prosecutions, extending exposure from 5 years to 10 years and applying retroactively to fraud that occurred before the law was passed. Defendants who thought there risk would end in 2025-2027 now face exposure through 2030-2032, and prosecutors are showing no signs of slowing down their investigations. If your facing potential PPP fraud charges or if you’re concerned about the statute of limitations in your case, consult with an experienced federal criminal defense attorney who understands how the 2022 extension affects your exposure and options.
We represent clients in PPP fraud cases throughout California and the federal system, and we regularly advise on statute of limitations issues, challenge improper tolling or extension arguments, and help defendants understand when there exposure ends. The 2022 extension was a game-changer that gave prosecutors far more time than originally anticipated, but it also created planning opportunities—knowing exactly when your statute expires allows you to assess risk over time and make informed decisions about cooperation, voluntary disclosure, or defense strategies. Call us for a consultation about your case.