What Happened
Between 2020 and 2021, thousands of SBA-approved lenders processed Paycheck Protection Program loans under expedited rules to quickly provide capital to businesses during the pandemic. The SBA granted delegated authority and streamlined procedures through interim final rules, allowing lenders to rely on borrower certifications instead of traditional documentation.
The program ended, but investigations continue.
Federal law extended the statute of limitations for COVID-19-related fraud offenses to 10 years. The Department of Justice, SBA Office of Inspector General, FBI, and COVID-19 Fraud Enforcement Task Force are still pursuing cases involving false certifications, inflated payroll claims, identity theft, and misuse of funds. Lenders that treated PPP retention like standard SBA loan documentation, six years after forgiveness or repayment, now face a mismatch between their records destruction schedules and active enforcement timelines.
Many institutions destroyed records they may still need.
Timeline
2020-2021: SBA issues interim final rules for PPP lending. Lenders process loans under delegated authority with streamlined underwriting. Early guidance focuses on six-year retention after forgiveness or repayment.
2021-2022: First wave of PPP forgiveness applications processed. Many lenders begin counting retention clocks from forgiveness dates.
2022, Present: Federal statute of limitations for pandemic fraud extended to 10 years. DOJ and task force investigations accelerate. Lenders receive document requests for loans issued three to four years earlier. Institutions realize their six-year retention schedules don't align with 10-year fraud exposure windows.
Ongoing: SBA reviews, audits, and fraud investigations continue. Lenders with high loan volumes face challenges retrieving documentation from legacy systems, physical storage, or already-destroyed files.
Which Controls Failed or Were Missing
Retention schedule didn't account for extended enforcement windows. Most lenders built PPP retention policies around the SBA's original six-year guidance. When federal law extended fraud statutes to 10 years, those schedules became insufficient. Records Control Schedules should tie retention to the longest applicable legal requirement.
No trigger review for statute changes. Institutions didn't reassess retention when enforcement statutes changed. Event-Based Retention requires monitoring regulatory updates that affect retention triggers. A statute extension is a retention-relevant event.
Hybrid records systems created gaps. Many lenders maintained PPP documentation across paper files, email, core banking systems, and third-party platforms. Without a centralized repository, institutions couldn't guarantee complete file sets during audits or investigations. Records declared in one system but referenced in another create retrieval risk.
No legal hold readiness for closed loans. Lenders treated forgiven PPP loans as closed transactions. When fraud investigations surfaced years later, institutions had no process to freeze disposition for specific loan files. A Records Freeze applied to already-destroyed records is useless.
Inadequate audit logs for borrower certifications. Lenders relied on borrower certifications but didn't always maintain audit trails showing what was reviewed, when, and who approved the file. Internal underwriting records, quality control checks, and approval workflows are critical during fraud investigations. Missing logs make it harder to defend underwriting decisions.
What the Relevant Standard Requires
The Generally Accepted Recordkeeping Principles (Principle of Retention) require organizations to maintain records for appropriate periods based on legal, regulatory, fiscal, operational, and historical requirements. "Appropriate" means the longest applicable requirement governs.
SBA interim final rules required lenders to preserve documentation supporting loan origination and forgiveness decisions. The rules didn't specify a maximum retention period, they set a floor. When federal fraud statutes extended to 10 years, that became the controlling retention requirement for PPP loan records.
ISO 30300 requires organizations to establish retention schedules that reflect current legal and regulatory obligations and to review those schedules when obligations change. A retention schedule is not static; it requires maintenance.
The GARP Principle of Availability requires records to be accessible and retrievable throughout their retention period. Storing PPP loan files across disconnected systems without a clear Business Classification Scheme or retrieval index violates this principle. If you can't produce the record when needed, retention duration is irrelevant.
For lenders subject to Bank Secrecy Act requirements, records supporting KYC reviews, suspicious activity documentation, and AML compliance must remain accessible during the entire period those records could be requested by regulators or law enforcement. A 10-year fraud statute means 10-year BSA record availability.
Lessons and Action Items for Your Team
Reassess retention schedules when statutes change. Don't wait for an audit request to discover your retention period is too short. Build a quarterly or semi-annual review into your Records and Information Management program. Monitor changes to statutes of limitations, regulatory enforcement guidance, and agency priorities. Update your Records Control Schedule accordingly.
Use the longest applicable requirement. If your PPP loans are subject to SBA guidance (six years), federal fraud statutes (10 years), state lending laws (varies), and potential civil litigation (statute depends on claim type), retain for 10 years minimum. Add a buffer if your institution has high fraud-investigation risk.
Centralize PPP records now. If your loan files are scattered across email, core systems, third-party platforms, and physical storage, consolidate them into a single digital repository with role-based access controls, audit logs, and encrypted storage. Implement a clear recordness determination: decide which system holds the official record and treat everything else as a copy.
Digitize physical files before they degrade. Paper loan files stored in offsite facilities face environmental damage, misfiling, and retrieval delays. Scanning and digitization improve retrieval speed, support remote access during audits, and reduce physical storage costs. If you're keeping paper for legal reasons, maintain digital copies as backup.
Build a legal hold process for closed loans. Forgiven loans aren't exempt from litigation holds. Create a workflow to apply Records Freezes to specific loan files when you receive an investigation notice, subpoena, or SBA review request. Tag those files in your document management system to block automated disposition.
Maintain underwriting audit trails. Keep internal review notes, approval workflows, quality control checks, and communications showing what your team evaluated during underwriting. These records demonstrate lender due diligence during fraud investigations. If you relied on borrower certifications under delegated authority, document what you reviewed and why you approved the file.
Test retrieval before you need it. Run a mock audit. Pull 20 random PPP loan files and see how long it takes to assemble complete documentation. If you can't produce a full file set within 48 hours, your system isn't audit-ready.
The PPP program ended, but the compliance obligation didn't. Your retention schedule should reflect that reality.
