Articles

COVID Relief Enforcement Is Not Over: Defending Against PPP Fraud Allegations and ERC Disallowances

Date: May 28, 2026

Introduction

The Internal Revenue Service’s April 27, 2026, announcement of a streamlined process for filing Form 907 to extend the deadline on Employee Retention Credit (ERC) disallowance challenges was, on its surface, a procedural housekeeping item. But the announcement carried a more substantive message: more than five years after Congress enacted the CARES Act, COVID-19 relief enforcement is not winding down. It is, in many respects, just hitting stride.

Businesses, nonprofits, and their advisors who assumed that the passage of time would close the book on Paycheck Protection Program (PPP) loans and ERC claims should reconsider. Congress established a 10-year statute of limitations for criminal charges and civil enforcement actions involving PPP fraud, with ‘notwithstanding’ language that supersedes shorter periods that would otherwise apply. The One Big Beautiful Bill Act, signed into law on July 4, 2025, extended the IRS assessment period for ERC claims to six years and created a new tier of “COVID-ERTC Promoter” penalties. The Department of Justice’s COVID-19 Fraud Enforcement Task Force has charged more than 3,500 defendants and continues to operate five regional Strike Forces, including one based in the District of Maryland. The IRS Criminal Investigation Division has more than 545 open ERC fraud investigations involving roughly $7 billion in claims.

This article addresses the two enforcement tracks that most often surface together in our practice: PPP loan fraud allegations (which can be civil, criminal, or both), and ERC disallowances and fraud investigations (which are mostly civil but increasingly criminal). The legal exposure is distinct, but the defense playbook overlaps substantially and the cost of waiting to engage counsel is, for both, considerable.
 

The Enforcement Landscape

The federal apparatus assembled to investigate and prosecute COVID-19 relief fraud is unusual in scale and persistence. The DOJ COVID-19 Fraud Enforcement Task Force (CFETF), established in May 2021, is an inter-agency partnership that includes the DOJ Criminal and Civil Divisions, U.S. Attorneys’ Offices, the FBI, the Small Business Administration Office of Inspector General (SBA-OIG), IRS Criminal Investigation, the U.S. Secret Service, and more than a dozen other federal agencies and Offices of Inspector General. As of the CFETF’s most recent comprehensive report, member agencies had charged more than 3,500 defendants with federal crimes, recovered over $1.4 billion in fraudulent proceeds, and produced more than 400 civil settlements and judgments.

The Task Force operates five regional Strike Forces based in the Districts of Maryland, New Jersey, Colorado, the Southern District of Florida, and a joint task force in the Eastern and Central Districts of California, each with dedicated prosecutorial resources for complex pandemic fraud cases. The Maryland Strike Force is particularly relevant for businesses and nonprofits in Whiteford’s primary service area, including those operating in the District of Columbia, Northern Virginia, and the broader Mid-Atlantic.

Two statutory developments have given enforcement officials substantially more runway than the original framework provided. The PPP and Bank Fraud Enforcement Harmonization Act of 2022, signed August 5, 2022, established a 10-year statute of limitations for both criminal charges and civil enforcement actions involving PPP fraud, codified at 15 U.S.C. §§ 636(a)(36)(P) and 636(a)(37)(P). The statute’s “notwithstanding any other provision of law” language overrides the shorter limitations periods that would otherwise apply to wire fraud (5 years) and aligns PPP enforcement with the existing 10-year period for bank fraud under 18 U.S.C. § 3293. For a borrower whose forgiveness application was filed in 2022, criminal and civil exposure now extends through 2032.

On the ERC side, the One Big Beautiful Bill Act extended the IRS assessment period for ERC claims to six years, doubling the standard three-year statute under IRC § 6501, and added significant new penalty provisions that we address in detail below.


PPP Loan Fraud: What Triggers AN Investigation

PPP fraud investigations originate from several sources: SBA-OIG audits, lender referrals, whistleblower complaints filed under the False Claims Act’s qui tam provisions, and increasingly, data-driven referrals from interagency analytic teams that flag loan patterns inconsistent with a borrower’s tax filings or industry profile. The most common factual triggers are not exotic. They are recurring fact patterns that the enforcement community has now catalogued and modeled:
  • Misrepresentations on the loan application regarding the borrower’s eligibility, employee count, or payroll amounts, including the threshold representation of “current economic uncertainty” that the SBA later applied to larger loans through good-faith certification reviews.
  • Ineligible use of proceeds. PPP funds were spent on items outside the statutory categories of payroll, rent, mortgage interest, utilities, covered operations expenditures, covered property damage costs, covered supplier costs, and covered worker protection expenditures.
  • Inflated payroll figures are used to justify a larger loan than the borrower would otherwise have qualified to receive.
  • Multiple-draw issues, including affiliated entities that should have been aggregated under the SBA affiliation rules but were applied for separately.
  • Discrepancies between the certifications made on the loan application, the certifications made on the forgiveness application (SBA Form 3508, 3508EZ, or 3508S), and the underlying payroll, banking, and tax records.

The triggering fact pattern matters because it shapes both the government’s theory of the case and the appropriate defense strategy. A borrower who overstated payroll by 15% on the application faces a very different posture than a borrower who created a shell entity to apply for a loan in the name of a non-operating business. Both can result in False Claims Act exposure; only the latter is likely to draw immediate criminal interest.


The Tax Trap: Improperly Forgiven PPP Loans Are Taxable Income

A development that has surprised many borrowers, that fundamentally changes how civil and criminal exposure should be analyzed, is the IRS Office of Chief Counsel’s position that improperly forgiven PPP loans constitute gross income to the borrower. The IRS Office of Chief Counsel has taken the position in a non-precedential memorandum that PPP amounts forgiven based on omissions or misrepresentations are includible in gross income where statutory forgiveness conditions are not met, potentially triggering penalties and interest.

In Chief Counsel Advice Memorandum 202237010 (dated August 19, 2022), the Office of Chief Counsel concluded that if a taxpayer obtains PPP forgiveness through omissions or misrepresentations and does not factually satisfy the conditions for a qualifying forgiveness under 15 U.S.C. §§ 636m and 636(a)(37)(J), the exclusion from gross income provided by 15 U.S.C. § 636m(i) and Section 276(b)(1) of the COVID-related Tax Relief Act of 2020 does not apply. The forgiven amount must be included in gross income under IRC § 61(a).

The memorandum is not a binding precedent. By its own terms, it “may not be used or cited as precedent,” but it reflects the IRS’s analytical position. The memo’s reasoning follows established income tax doctrine. Under the general principles articulated in Commissioner v. Glenshaw Glass Co., 348 U.S. 426 (1955), gross income includes all “undeniable accessions to wealth, clearly realized, and over which the taxpayers have complete dominion.” The exclusion in § 636m(i) is, by its terms, available only for forgiveness that meets the statutory conditions. When forgiveness is obtained through misrepresentation, those conditions are not met, the exclusion does not apply, and the default rule of § 61(a) controls. The tax consequences in any specific case turn on the facts and applicable law; the IRS memorandum reflects an enforcement position and is not binding precedent.

The memorandum also invokes the claim-of-right doctrine articulated in North American Oil Consolidated v. Burnet, 286 U.S. 417 (1932), and reaffirmed in James v. United States, 366 U.S. 213 (1961). Under that doctrine, a taxpayer who acquires earnings under a claim of right,  lawfully or unlawfully, must include those earnings in gross income for the year of receipt, even if the taxpayer may later be required to return them. A subsequent repayment to the SBA may give rise to a deduction under IRC § 162 or § 165 in the year of repayment, but it does not retroactively eliminate the income inclusion.

The practical consequence is considerable. A borrower whose $250,000 PPP loan was improperly forgiven in 2021 faces (a) potential SBA repayment of the loan principal; (b) potential False Claims Act treble damages and per-claim penalties; (c) potential criminal exposure; and (d) income tax liability on the $250,000 inclusion in 2021 gross income, plus interest, plus an accuracy-related penalty under IRC § 6662 (20%) or, if the conduct was willful, a civil fraud penalty under IRC § 6663 (75%). These are stacked, not alternative.


Civil vs. Criminal PPP Exposure

PPP fraud allegations can proceed on several tracks, and the same conduct frequently triggers more than one. Counsel’s first task is usually to map the universe of potential exposure before deciding how to respond to any single agency contact.

On the civil side, the False Claims Act (31 U.S.C. §§ 3729–3733) is the most common vehicle for PPP enforcement. The FCA imposes treble damages plus statutory per-claim penalties (currently in the range of approximately $14,000 to $28,000 per claim, adjusted annually for inflation). FCA cases are often initiated by qui tam relators, private whistleblowers, typically former employees, business partners, or lenders, who file under seal and stand to receive a share of the recovery if the government intervenes or the matter settles. The June 2024 multi-nonprofit settlement discussed below originated as a qui tam suit; the relator’s share was approximately $700,000 of a $5.8 million total recovery.

On the criminal side, the charges most commonly used in PPP fraud prosecutions are bank fraud (18 U.S.C. § 1344), wire fraud (18 U.S.C. § 1343), false statements to a federal agency (18 U.S.C. § 1001), false statements to a financial institution (18 U.S.C. § 1014), and conspiracy to defraud the United States (18 U.S.C. § 371). Where loan proceeds were laundered through multiple accounts or used to acquire assets, money laundering charges under 18 U.S.C. §§ 1956 and 1957 frequently follow. Tax charges under IRC §§ 7201 (evasion) or 7206 (false return or aiding and assisting) may attach where the borrower failed to report improperly forgiven loan proceeds as income, consistent with CCA 202237010.

These tracks can run sequentially or in parallel. An SBA-OIG audit can produce a referral to DOJ Civil for FCA enforcement, with a separate referral to a U.S. Attorney’s Office for criminal review. The IRS can independently open a civil examination. Each agency operates on its own timeline, and decisions made in one proceeding can foreclose or compromise positions in another. Document preservation, privilege management, and witness preparation must be coordinated from the outset. Positions taken or statements made in any one proceeding can have consequences across others; counsel should coordinate timing and substance across tracks.


Special Considerations for Nonprofits

Nonprofit organizations face a distinctive set of PPP issues that have generated a growing line of False Claims Act enforcement. The PPP’s eligibility rules for tax-exempt entities were narrow and, in the early days of the program, widely misunderstood. As a baseline, the CARES Act made PPP loans available to certain 501(c)(3) charitable organizations and 501(c)(19) veterans organizations, with later legislation expanding eligibility to certain 501(c)(6) trade associations under specified conditions. With limited exceptions added later for certain 501(c)(6) entities, organizations classified under other 501(c) subsections were generally not eligible during 2020 and most of 2021.

Several nonprofits that obtained loans despite being ineligible have now settled FCA allegations. In June 2024, four nonprofit organizations — the Rancho Santa Fe Association (a 501(c)(4) homeowners' association) and three private golf and country clubs operating as 501(c)(7) social clubs (Pine Mountain Lake Association, Glendora Country Club, and The Palms Golf Club) — collectively paid more than $5.8 million to resolve allegations that they knowingly applied for and obtained PPP loans for which they were ineligible. In a separate matter announced in August 2025, Energy Federation, Inc., a Massachusetts 501(c)(4) nonprofit, paid $1 million and admitted that, after discussing its eligibility with the bank processing its loan application, it submitted the application without disclosing its 501(c)(4) status to SBA. The Michigan Education Association (a 501(c)(5)) and its affiliated 501(c)(9) voluntary employees’ beneficiary association settled similar allegations for a combined approximately $226,000.

For nonprofit boards and general counsel, these cases create exposure that is, in some respects, broader than the financial settlement itself. Form 990 disclosure obligations,  particularly Schedule O (Supplemental Information) and Schedule L (Transactions With Interested Persons), and, depending on the matter, the legal proceedings disclosure in Form 990 Part VI, may require reporting of material government inquiries and settlements. State attorney general oversight of charitable assets is independently triggered in jurisdictions including New York, Maryland, the District of Columbia, and others where Whiteford has a substantial nonprofit practice, and donor and grantor relationships can be materially affected by public enforcement actions. Boards have fiduciary obligations to investigate, document, and, where appropriate, voluntarily disclose problematic loans before the SBA or DOJ initiates contact.

The ERC Side: Enforcement Surge and the OBBBA Watershed

Where PPP enforcement has matured into a settled framework, ERC enforcement is still actively evolving, and 2025 was a major year. The Employee Retention Credit, originally enacted in the CARES Act and expanded in subsequent legislation, was a refundable payroll tax credit available to employers that experienced either a full or partial suspension of operations due to a government order, or a significant decline in gross receipts during 2020 or 2021. The credit’s combination of generous benefits (up to $26,000 per employee across eligible quarters), broad eligibility criteria, and a long claiming window made it a magnet for aggressive marketing and, in many cases, outright fraud.

IRS Criminal Investigation has opened more than 545 ERC fraud investigations involving approximately $7 billion in claims. As of recent public reporting, more than 75 of those investigations had resulted in federal charges, with 38 convictions and an average prison sentence of approximately 21 months. The largest indictment to date came on January 22, 2025, when a grand jury in the Eastern District of New York returned charges against Keith Williams, Janine Davis, Morais Dicks, James Hames, Jr., Jamari Lewis, Ewendra Mathurin, and Tiffany Williams for conspiracy to defraud the United States, wire fraud, and aiding and assisting the preparation of false tax returns. The defendants are alleged to have operated through an entity called “Credit Reset,” filing more than 8,000 quarterly payroll tax returns claiming over $600 million in ERC credits for businesses that, in many cases, had no legitimate operations or employees. The charges remain allegations; the defendants are presumed innocent.

On July 4, 2025, the One Big Beautiful Bill Act became law and added three structural changes to ERC enforcement that meaningfully expand IRS and DOJ leverage:
 
  • The law invalidates only pending ERC claims for 2021 Q3 and Q4 that were filed after January 31, 2024; claims already paid before July 4, 2025, are not affected. 2020 and 2021 Q1-Q2 claims are not retroactively impacted. Claims already paid before July 4, 2025, are unaffected. The provision invalidates claims for the third and fourth quarters of 2021 only; 2020 ERC claims and the first two quarters of 2021 are not retroactively affected.
  • Six-year statute of limitations on IRS assessment of all ERC claims, doubling the standard three-year period under IRC § 6501. The extended period begins from the latest of the original return filing date, the deemed filing date, or the date the credit or refund claim was submitted. The practical result is that an ERC claim filed in early 2024 remains subject to IRS examination through 2030. The six-year period runs from the latest of the original filing date, the deemed filing date, or the date the ERC claim was submitted.
  • A new “COVID-ERTC Promoter” penalty regime under amended IRC §§ 6695 and 6701. Promoters who aided fraudulent or negligent ERC claims face penalties of $200,000 per violation for entities or $10,000 per violation for individuals, or 75% of the promoter’s ERC advisory income, whichever is greater. A separate $1,000 penalty applies for each failure to satisfy due diligence requirements. The penalties reach back to March 12, 2020, the date the ERC program began, while the due diligence requirements apply only prospectively from enactment.

The OBBBA also classifies ERC-related activity as a listed transaction with mandatory reporting requirements, materially increasing the disclosure burden on advisors and promoters. Certified Professional Employer Organizations are excluded from the promoter definition. Together, these changes signal that ERC enforcement will remain a substantial portion of IRS examination and DOJ Tax Division activity through at least the end of the decade.


ERC Disallowance, Letter 105-C, and the New Form 907 Option

When the IRS disallows an ERC claim in full or in part, the taxpayer receives Letter 105-C (full disallowance) or Letter 106-C (partial disallowance). Under IRC § 6532(a), the taxpayer generally has two years from the date of the disallowance letter to bring a refund suit in federal court. That two-year period is not extended by filing a protest with the IRS Independent Office of Appeals. A taxpayer who waits for Appeals to resolve a disallowance can find the statutory window closed before the administrative review is complete, foreclosing the option of refund litigation altogether.

The April 27, 2026, IRS announcement provides a procedural remedy for taxpayers caught in that timing trap. The IRS has created a streamlined process for filing Form 907 (Agreement to Extend the Time to Bring Suit), which has long been available in principle but was procedurally difficult to use. Under the new process, taxpayers who are within six months of the two-year deadline and awaiting IRS action on a Letter 105 C or 106 C may use the streamlined Form 907 process via the IRS Document Upload Tool by selecting notice CP320B. The IRS is issuing CP320B to identified taxpayers; those who believe they qualify may submit even without receiving CP320B, following the IRS’s step-by-step instructions. The IRS is sending Notice CP320B to taxpayers identified as eligible for the streamlined submission, though taxpayers who believe they qualify may submit Form 907 even without receiving CP320B, following the step-by-step instructions at IRS.gov/CP320B.

The Form 907 extension is significant for two reasons. First, it preserves the taxpayer’s right to refund litigation while permitting continued administrative engagement, which is frequently the less expensive and more flexible forum for resolving a disallowance. Second, it signals that the IRS recognizes the practical mismatch between the two-year statutory clock and the time required for substantive Appeals consideration. Taxpayers within six months of the deadline who have not received CP320B should not assume ineligibility; they should consult counsel about whether the streamlined process applies to their facts.
 

Practical Considerations for Counsel and Clients

Whether the matter is PPP, ERC, or both, several recurring issues shape the early-stage defense posture and warrant attention from counsel and clients alike.

Parallel proceedings management. PPP and ERC matters frequently produce simultaneous civil and criminal exposure. A client facing an SBA-OIG audit may also be the subject of a sealed qui tam complaint and an open IRS-CI investigation. Statements made in response to a civil inquiry can be used in a parallel criminal matter; civil discovery in an FCA case can produce material relevant to a grand jury investigation. Coordinating across tracks requires either a single counsel team with cross-disciplinary capacity or careful coordination between civil and criminal counsel under a joint defense or common interest framework.

Kovel arrangements with accountants. Where the underlying issue involves the accuracy of payroll computations, employee counts, gross receipts declines, or PPP forgiveness applications prepared by an outside CPA or payroll service, the original preparer is both a potential witness and, in some cases, a potential target. Communications between the client and the original CPA are not privileged. A properly structured Kovel engagement (United States v. Kovel, 296 F.2d 918 (2d Cir. 1961)), in which the accountant is retained by counsel for the purpose of facilitating legal advice, can extend the attorney-client privilege to accountant work product but requires careful documentation and is not available to retroactively privilege pre-existing communications.

Eggshell-audit posture. An ordinary IRS examination becomes an “eggshell audit” when the taxpayer has potential criminal exposure that the civil examiner has not yet identified. Statements, documents, and concessions made during the civil exam can become evidence in a subsequent criminal referral. Where eggshell concerns exist, counsel typically advises the client to respond to information document requests in writing rather than through interviews, to assert any applicable privileges, and, in some cases, to consider voluntary disclosure before the matter is referred.

Voluntary disclosure. The IRS-specific ERC Voluntary Disclosure Program closed on November 22, 2024, and has not been reopened. The general IRS Voluntary Disclosure Practice (VDP), administered by IRS Criminal Investigation, remains available in 2026 for taxpayers with willful violations. The IRS has solicited public comments on proposed updates to the VDP; if adopted, changes could affect penalty structures and standardize the disclosure period. As of this writing, the ERC-specific program has closed. Voluntary disclosure is not a remedy for inadvertent error; it is a path to resolve willful conduct before the IRS opens an audit or referral.

Document preservation. Both PPP and ERC defense matters depend heavily on documentary records that businesses may not have systematically preserved: the original loan application and supporting payroll records; the forgiveness application and the calculations underlying it; communications with the lender, the CPA, and any ERC promoter; bank records reflecting the use of loan proceeds; government orders relied upon for ERC eligibility; and gross receipts records establishing the eligibility decline. The 10-year SOL for PPP and the 6-year SOL for ERC make the document retention horizon substantially longer than the standard seven-year guidance many businesses follow.

COVID-19 relief enforcement is now a multi-year, multi-agency project with a 10-year runway on the criminal and FCA side, a 6-year runway on the IRS ERC assessment side, and active task force resources committed through the end of the decade. Businesses and nonprofits that received PPP loans or claimed the ERC — and the accountants, payroll providers, and advisors who assisted them — should treat any government contact, however informal, as the beginning of a process that may involve multiple agencies and stretch over years.

Whiteford’s tax controversy and criminal tax defense attorneys represent businesses, nonprofits, and individuals in federal and state tax disputes across the firm’s nine-state footprint. For questions about PPP loan defense, ERC disallowance, or any related SBA, IRS, or DOJ matter, contact Michael March at Whiteford’s Columbia, Maryland office or visit irstax-attorney.com.
This article is for general informational purposes and does not constitute legal advice. The application of statutes, regulations, and case law to specific facts varies, and readers should consult qualified counsel about their particular situations.