If you received a Paycheck Protection Program loan, you might be eager to move past pandemic recordkeeping. Your loan forgiveness came through, the crisis ended, and you've resumed normal operations.
However, federal investigators haven't moved on. Congress extended the statute of limitations for COVID-19-related fraud to 10 years, meaning PPP records from 2020 could be scrutinized in 2030. The Small Business Administration still conducts reviews, and agencies continue investigating suspected misuse years after forgiveness approval.
This checklist will help ensure your PPP documentation meets retention requirements and remains accessible when needed.
Prerequisites
Before starting the checklist, verify:
- You know your forgiveness or repayment date. The six-year minimum retention period starts from this date, not when you received the loan.
- You've identified all PPP record locations. Check your accounting software, email archives, payroll systems, lender portals, and any physical files.
- You understand your industry's retention requirements. Some industries require longer retention periods for financial records.
- You've consulted legal or accounting counsel. Given the 10-year statute of limitations for fraud investigations, many advisors now recommend retaining PPP records for at least 10 years instead of the six-year minimum.
PPP Record Retention Checklist
1. Borrower Application Records
Done when: You can produce your complete PPP borrower application form, ownership disclosures, and eligibility certifications within one business day.
Requirement: The SBA requires retaining all records supporting your eligibility certifications.
Good looks like: A single digital folder containing your signed application, supporting schedules, and any correspondence with your lender about eligibility questions. Each document is clearly labeled with the loan number and date.
2. Payroll Calculation Documentation
Done when: You maintain complete payroll records for the covered period and the comparable prior period used in your calculations.
Requirement: The SBA requires borrowers to maintain records supporting payroll calculations used to determine loan amounts and forgiveness.
Good looks like: Payroll processor reports, Form 941 filings for the relevant quarters, state unemployment filings, and any worksheets showing how you calculated average monthly payroll. An examiner should be able to recreate your payroll math from these records alone.
3. Employee Count and Compensation Records
Done when: You can demonstrate full-time equivalent employee counts and individual compensation levels for all employees included in your PPP calculations.
Requirement: The SBA requires documentation of employee counts used in forgiveness calculations.
Good looks like: Individual employee files showing compensation, benefits contributions (health insurance, retirement), hire dates, and termination dates if applicable. If you experienced workforce reductions and later rehired employees, maintain records showing both the reduction and rehire efforts.
4. Approved Expense Documentation
Done when: You've retained receipts, invoices, and payment records for all PPP funds spent on approved expenses.
Requirement: Borrowers must maintain records supporting approved use of PPP funds, including payroll costs, rent, utilities, mortgage interest, and other qualifying expenses.
Good looks like: Bank statements showing PPP fund deposits and subsequent payments, plus underlying invoices for rent/lease payments, utility bills, mortgage interest statements, and any other non-payroll expenses. Each payment should trace back to the PPP account and forward to a qualifying expense category.
5. Forgiveness Application Package
Done when: You maintain your complete forgiveness application as submitted, including all schedules, certifications, and lender correspondence.
Requirement: The SBA requires retention of forgiveness applications and supporting documentation.
Good looks like: The exact package you submitted to your lender, plus any follow-up questions and your responses, and your final forgiveness determination letter. Keep the full application showing your calculations, not just the approval letter.
6. Bank Transaction Records
Done when: You can produce bank statements and transaction records showing PPP fund receipt and disbursement for the entire covered period.
Requirement: While not explicitly called out as a separate category, bank records support both use-of-funds verification and audit trails.
Good looks like: Complete monthly statements for accounts that received PPP deposits, plus ACH records, check images, and wire transfer confirmations for all payments made with PPP funds.
7. Tax Filing Records
Done when: You've retained all tax filings (federal and state) that correspond to your PPP covered period and forgiveness application.
Requirement: Tax filings support both payroll calculations and employment documentation.
Good looks like: Form 941 quarterly payroll tax returns, annual Form 940 unemployment filings, state unemployment tax returns, and any amended returns filed during or after the covered period.
8. Digital Accessibility and Backup
Done when: Your PPP records are digitized, indexed, and backed up in at least two separate locations.
Requirement: While the SBA doesn't mandate digital storage, you must be able to produce records during audits or investigations, which may happen years from now.
Good looks like: Scanned copies of all paper records stored in organized folders (by document type and date), with a master index showing what you have. Your backup system ensures you can recover records if your primary storage fails. Cloud storage with proper access controls works well here.
9. Retention Schedule Documentation
Done when: You've created a written retention schedule specifying when PPP records will be eligible for destruction and who authorizes that destruction.
Requirement: Not explicitly required by the SBA, but essential for defensible recordkeeping.
Good looks like: A simple document stating: "PPP loan records for loan #[number] will be retained until [date, at least 10 years from forgiveness], at which time [title] will review for Records Disposition Authority." Update this if you receive any legal hold notices or audit requests.
Common Mistakes
- Destroying records after six years without considering the extended statute of limitations. The six-year minimum from the SBA predates the 10-year fraud statute. Many attorneys now recommend the longer period.
- Keeping only the forgiveness approval letter. If you're audited, you'll need to reproduce your calculations, not just prove you were forgiven.
- Storing records across multiple systems without an index. You won't remember in 2028 which payroll reports are in your accounting software versus your email versus your lender portal.
- Failing to digitize paper records. Paper degrades, gets misfiled, and becomes inaccessible when staff turn over.
- Not documenting why you made specific eligibility or calculation decisions. If your application involved judgment calls about employee classification or expense eligibility, document your reasoning contemporaneously.
Next Steps
If you found gaps in this checklist, address them now while records are still accessible. Contact former lenders, payroll processors, or accountants to retrieve missing documentation. Don't wait for an audit notice to discover you can't find your covered-period bank statements.
If you're managing PPP records for multiple entities or locations, create a master tracking sheet showing compliance status for each loan. Assign someone to own PPP record retention as part of your broader Records and Information Management program.
And if you haven't already, consult with legal counsel about whether your specific situation warrants retention beyond 10 years. Some businesses operating in highly regulated industries or facing existing litigation may need to preserve PPP records even longer.
The audit you prepare for today may not happen until 2027 or later. But when it does, you'll respond in days instead of months.
