Offit Kurman Blogs

When Congress passed the CARES Act in March 2020, it did more than inject liquidity into the economy through programs like the Paycheck Protection Program (PPP). It also created a parallel set of compliance obligations that are only now coming into sharper focus. If that sounds familiar, it should.

In a prior blog post, I warned about the Employee Retention Credit (ERC) deadline quietly creeping up on businesses. That dynamic, where relief programs created at the same moment begin to generate legal exposure years down the line, is not unique to ERC. PPP is now entering that same phase, but with a more aggressive enforcement backdrop. While ERC issues often surface through a lack of IRS administrative action and taxpayers facing looming deadlines to file an action in court, PPP is increasingly appearing in the form of civil investigations because of looming government deadlines. And the Department of Justice is running out of time.

Most PPP-related fraud claims are governed by statutes of limitation that trace back to the earliest loans issued in 2020. As those deadlines approach, DOJ is not winding down its efforts; it is accelerating them. The result is a noticeable shift in how these cases are being pursued. One of the clearest indicators is the surge in Civil Investigative Demands, or CIDs. These are not informal inquiries. A CID allows the government to compel documents, written responses, and sworn testimony, often before a lawsuit is filed. In practice, it is a tool designed for speed, used when the government needs to build a case and preserve claims before time expires.

What might have been a slow-moving inquiry a year ago is now being compressed into a much tighter timeline. Investigations are more targeted, more coordinated, and increasingly driven by data: loan size, forgiveness certifications, and application representations are all being evaluated with renewed urgency. But there is another dynamic at play. One that is harder to see and harder to measure.

PPP loan data is, by and large, public. That transparency was intended to promote accountability. In practice, it has also created fertile ground for False Claims Act whistleblower activity. There is growing speculation that a meaningful number of PPP investigations are being fueled by qui tam filings: complaints brought by private relators on behalf of the government. The challenge, of course, is that qui tam actions are filed under seal. They are confidential by design. That means a business receiving a CID has no way of knowing whether the investigation stems from internal government analysis, a data-driven flag, or a whistleblower complaint. Nor is there any immediate way to assess the credibility or motivation behind the underlying allegations.

In other words, the investigation may already be several steps along before the target even knows it exists.

For businesses and their counsel, that uncertainty adds another layer of complexity. You are not just responding to the government, you are potentially responding to an unseen relator, with unknown information and unknown incentives, whose allegations have already cleared at least an initial threshold of scrutiny.

That reality reinforces the broader point: We are at an inflection point where CARES Act relief is transitioning into CARES Act enforcement. ERC deadlines are closing in. PPP statutes of limitation are approaching. And the government is actively working, possibly with the assistance of private whistleblowers, to ensure that it does not leave potential claims on the table.

So it is important to understand what it means if your company is caught in the crosshairs of scrutiny. A CID is not something to set aside or address casually. It is the start of a serious engagement with the government, and the response strategy needs to reflect that reality. Early assessment of exposure, careful control of the narrative, and thoughtful engagement can often make the difference between a manageable resolution and a much more costly outcome.

At the same time, it is worth remembering that not every PPP case fits the narrative of fraud. Many businesses were navigating unprecedented uncertainty in real time, making decisions based on guidance that evolved rapidly. Certifications made in 2020 are now being revisited with the benefit of hindsight, and sometimes with a level of scrutiny that overlooks the context in which those decisions were made. That nuance matters. And it is often where experienced counsel can add the most value.

The broader takeaway is this: the same legislation that created opportunity in 2020 is now creating exposure in 2025 and beyond. ERC and PPP may follow different enforcement paths, but they share a common origin, and increasingly, a common sense of urgency. Add in the reality of sealed qui tam filings and public data-driven scrutiny, and the enforcement landscape becomes even more complex.

In fact, that urgency just got a small, but notable, twist. As of April 27, 2026, the IRS introduced a new option for taxpayers whose ERC claims have been disallowed: the ability to request additional time to pursue administrative review by effectively tolling the clock before heading to court. In theory, this gives businesses a bit of breathing room when deadlines are tightening and pressure is building. In practice, however, it’s a brand-new procedural tool with very little track record, limited eligibility, and plenty of unanswered questions about how often it will be granted or how smoothly it will function. In other words, just as the enforcement environment is accelerating, the IRS has added a potential off-ramp, but whether it’s a reliable one or just another layer of complexity remains to be seen.

The government is watching the clock.

You should be too.

If you are seeing an uptick in PPP-related inquiries or CIDs, or dealing with ERC issues as those deadlines approach, you are not alone. These matters are becoming more common, more compressed, and more consequential. It may be time to call in counsel. Because when the clock is running out, or the government is knocking at your door, the difference between exposure and resolution is strategy.