DOJ & SBA Ramp Up Pandemic Relief Fraud Enforcement

By Sam Crockett Neel, Sarah E. Delaney, and Nicole Redmond

On September 14, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division, U.S. Small Business Administration (SBA), and SBA Office of Inspector General announced “Operation NO DOZE,” stating that 500 prosecutors across the country are focused on pandemic relief fraud and announcing that a summer “surge resulted in fraud enforcement actions spanning over 160 criminal defendants and involved approximately $245 million dollars in intended loss to American taxpayers.”¹ SBA also announced repayment “demand letters going out to suspected fraudsters” and suspensions of 870,000 borrowers “tied to $39 billion in suspected fraudulent” Paycheck Protection Program (PPP) and COVID-19 Economic Injury Disaster Loan (EIDL) activity, and it highlighted its April 2026 referral to the Treasury Department (Treasury) of 562,000 suspected fraudulent pandemic-era loans tied to $22 billion in total funds.²

However, what the government characterizes as “fraud” may be actions taken based on good-faith interpretations of unclear or evolving program rules, not intentional misconduct. We have seen this narrative play out repeatedly throughout our experience advising hundreds of small businesses facing SBA audits, administrative appeals, and False Claims Act (FCA) claims and resulting DOJ investigations. The SBA rapidly rolled out its pandemic-era relief programs, including the PPP, EIDL, Restaurant Revitalization Fund (RRF) Grants, and Shuttered Venue Operators Grants (SVOG). This chaotic program implementation led to shifting administrative guidance and incomplete or inconsistent government application forms and instructions, which often explain some of the suspected fraud. Accordingly, many small businesses will be shocked to learn that they are now being targeted as “fraudsters.” And these fraud investigations will likely put renewed strain on many small businesses that paid their employees or spent funds as intended after receiving pandemic relief but are now facing demands to pay the government amounts that they do not have, six years post-COVID.

Borrowers may face different types of enforcement actions, including SBA loan reviews and forgiveness denials, suspension notices, repayment demands, and DOJ investigations. Each path carries different standards, notice requirements, remedies, and penalties or damages.

A. SBA Review and OHA Appeals

Most PPP loans were forgiven or denied by the SBA years ago. If the SBA reverses a forgiveness decision to demand repayment of all or a portion of a previously forgiven loan, the SBA should issue a new “final loan review decision” (FLRD), and the appeal should be governed by the process established in a final rule published by the SBA in 2020.³ A borrower must file an appeal petition with the SBA Office of Hearings & Appeals (OHA) within 30 calendar days after the borrower—not the lender—receives the FLRD. In OHA appeals, the borrower has the burden to show that the SBA’s decision was based on clear error of fact or law.

OHA may affirm, reverse, or remand the SBA’s FLRD. A borrower must exhaust its appeal rights at OHA before seeking judicial review in federal court under the Administrative Procedure Act (APA). In APA cases, a federal court shall hold an SBA decision unlawful if it was “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law”; “in excess of statutory jurisdiction [or] authority”; or “without observance of procedure required by law[.]”⁴

The timing of any post-forgiveness reversal may become significant in OHA and subsequent APA litigation, particularly where the administrative record establishes substantial delay and does not adequately explain the basis for reopening the prior determination more than four years later. Additionally, SBA hired hundreds of attorneys and professionals to handle the deluge of PPP borrower appeals at OHA in 2022, but many of these attorneys are no longer at SBA, so it is unclear whether SBA has the bandwidth to handle a substantial uptick in administrative enforcement, appeals, and litigation.

B. NO DOZE Repayment Demand Notices

As of September 22, 2026, SBA has not published a final rule or procedural notice specific to NO DOZE notices. NO DOZE notices seem to simply demand repayment within 30 days (without specifying whether it is 30 days from the notice date or 30 days from the date of receipt) and threaten administrative action, including AFCA enforcement, referral to DOJ, or referral to Treasury for collections. In the notice, the SBA should explain why the borrower is receiving a NO DOZE notice, but it may offer a vague reason, such as loan “irregularities” identified by the SBA. It does not appear that the notices will offer a formal appeal process, but they offer recipients or their attorneys the option to “discuss the matter” by replying to an SBA email account. We have seen the SBA take this less formal “reconsideration” approach for recipients of RRF repayment demands, resulting in substantial uncertainty regarding the status of their requests and available avenues for appeal. Borrowers that receive a NO DOZE notice should not ignore the stated 30-day deadline and immediately consult counsel to assess available response options.

C. Treasury Referral and Potential Collection

Before SBA refers a PPP or EIDL loan to Treasury for collection, the debt generally must be past due and legally enforceable, and SBA must satisfy applicable notice and administrative-review requirements. Federal debt-collection law requires notice of the debt and proposed collection action and, where administrative offset is contemplated, an opportunity to inspect records, contest the debt, and enter into a repayment agreement. SBA also must certify that the debt is eligible for referral and that applicable procedures have been followed.⁵ Accordingly, a borrower may have grounds to challenge a Treasury referral or subsequent collection action where SBA failed to provide required “due process” notice or an opportunity for agency review of the debt determination. The specific requirements vary depending on whether the debt is referred for Treasury cross-servicing or administrative offset.⁶

Notwithstanding the above, we have seen many instances where SBA referred a debt to Treasury without sending the borrower the required due process letter. Similarly, we have seen cases where borrowers never received notice from Treasury regarding any debt, and the first they hear of the potential debt is from a private debt collection agency demanding payment for the loan amount with a 30% assessed fee. In these cases, SBA counsel have generally been receptive to recalling improperly referred debts, but increasing enforcement volume may strain the agency’s capacity to resolve these matters promptly.

D. Civil FCA Enforcement

FCA qui tam complaints are filed under seal under 31 U.S.C. § 3730(b). The government has at least 60 days to intervene or decline to. DOJ regularly seeks extensions from the court to make an intervention decision, sometimes taking years to do so. After unsealing and service, a declined case proceeds as civil litigation unless the relator dismisses the complaint after DOJ declines to intervene.

Unlike an administrative loan review denial, an FCA case generally requires a false claim or materially false statement connected to payment, made knowingly. “Knowingly” includes actual knowledge, deliberate ignorance, or reckless disregard. Honest mistake and mere negligence are insufficient to prove the mental state required for a false claim. Materiality relates to whether the falsehood had a real tendency to influence the government’s payment decision. In PPP cases, the emergency rollout, changing rules, contemporaneous guidance, and particular form bear on intent, falsity, and materiality.

Many, if not most, FCA qui tam PPP cases⁷ are being filed by serial relators that have lodged dozens or hundreds of nearly identical complaints based on publicly available information and involve whether the borrower was “small” enough to receive the loan. These cases usually involve a claim that the borrower, together with its “affiliates,” had more than 500 employees for first draw loans (or 300 employees for second draw loans) and was thus ineligible for the loan received. But an eligibility analysis is usually not so clear-cut. For example, the borrower may have qualified under the alternative size standard or a different size standard based on its North American Industry Classification System (NAICS) code; its affiliation with other companies may have been unclear; it may have received guidance from its lender or an outside advisor that it was eligible; or the SBA may have directly or indirectly given guidance that the business reasonably relied upon in determining eligibility.

E. AFCA Enforcement

The Administrative False Claims Act (AFCA) (formerly the Program Fraud Civil Remedies Act)⁸ provides an administrative alternative to civil FCA litigation. It authorizes federal agencies, including the SBA, to impose civil penalties of up to $14,308 per false claim or statement (adjusted for inflation) and assessments of up to double the amount of the original claim through an administrative hearing before an agency Administrative Law Judge. The AFCA’s jurisdictional threshold for individual claims increased from $150,000 to $1 million this year. In the PPP and EIDL context, AFCA proceedings may target alleged false statements or claims in loan applications, eligibility certifications, or forgiveness requests. Because AFCA proceedings are administrative rather than judicial, SBA can pursue them directly through the administrative process without first obtaining DOJ intervention in a civil FCA action.

A. Civil FCA & AFCA claims

Under § 3731(b), a civil FCA action must be brought within six years after the violation, or three years after the responsible official knew the material facts, but no more than ten years after the violation. The government will likely argue for a ten-year FCA period. The PPP and Bank Fraud Enforcement Harmonization Act of 2022⁹ provides that “[n]otwithstanding any other provision of law,” any “civil enforcement action” alleging PPP borrower fraud must be filed within ten years.¹⁰ The COVID-19 EIDL Fraud Statute of Limitations Act of 2022 established a similar period for EIDL fraud.

FCA defendants should not accept a ten-year limitations period without scrutiny. Section 3731(b) is the FCA’s specific limitations provision, and Congress did not amend it when enacting the PPP and EIDL provisions. The interaction between these provisions and § 3731(b) has not been squarely resolved by a federal appellate court. Defendants should preserve the FCA’s time bar argument.

The AFCA borrows the civil FCA’s dual-trigger limitations framework. Under 13 C.F.R. § 142.9(c), the SBA must file an administrative complaint by the later of six years from the date of the violation or three years from the date the agency head knew or reasonably should have known the material facts, but no later than ten years from the date of the violation. The 2022 PPP and EIDL extension acts do not expressly amend these deadlines.

B. Criminal Charges

The general federal statute of limitations is five years under 18 U.S.C. § 3282, but the 2022 PPP and EIDL extension acts each extended it to ten years for specified fraud offenses. Section 3293 separately extends the period for offenses affecting a financial institution. Unlike civil FCA claims described above, the outer boundary for 2020 criminal fraudulent conduct can potentially extend to 2030.

C. SBA Audits and New Final Loan Review Decisions

The SBA’s PPP “audit window” is generally considered to be six years from the forgiveness decision date for loans over $150,000 and three years for smaller loans. These periods derive from SBA’s requirement that PPP borrowers retain key loan documentation for the corresponding period after the forgiveness decision date. There have not yet been any published rules or case law relating to the statute of limitations where SBA initiates a loan review during the audit window but does not issue a new final loan review decision during that period. Administrative law principles, laches, and due process constraints should limit the SBA’s authority, but this remains an open question.

D. Suspensions

The SBA has not published an applicable statute of limitations governing SBA suspensions of pandemic relief recipients. Suspension authority remains subject to the statutory and regulatory framework governing the particular suspension and to applicable procedural and due process requirements. Suspension can carry collateral consequences for businesses and their principals, including restrictions on participation in certain federal programs and transactions. Borrowers should assess promptly whether they have grounds to challenge the suspension, including on evidentiary, notice, or due process grounds.

Create a Loan File. At counsel’s direction, collect and preserve key loan documents, including loan applications, loan calculations, bank records, payroll documents, tax returns, affiliation and eligibility analyses, forgiveness applications and supporting documentation, lender communications, communications with accountants and counsel, and prior SBA loan review notices and responses. Counsel should direct this process to assess privilege and preservation obligations before any materials are produced to the government or a third party in response to a demand or subpoena.

Update Contact Information. If the employee who corresponded with the lender or SBA is no longer with the company, ensure a valid email address is on file and monitored. If the company has changed physical addresses or an address is not regularly used, update it or designate someone to monitor communications. Do not let a new FLRD denying forgiveness or a 30-day repayment demand letter go unnoticed.

Contact Experienced Counsel. Upon receipt of an SBA Demand Letter, Loan Review Notice, Final Loan Review Decision, Civil Investigative Demand, or correspondence from DOJ or a U.S. Attorney’s Office, contact experienced counsel immediately. Before responding substantively to DOJ, a U.S. Attorney’s Office, SBA, or another government investigator, businesses should consult counsel regarding the appropriate response and preservation obligations.