In Paycheck Protection Program (PPP) loan applications, how funding needs and eligibility criteria are defined will directly affect the legal liability risks a company may face. Goodwin law firm partner Annie Railton, at aAirbase webinar, pointed out that although the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) added multiple layers of oversight when establishing PPP loans for businesses with fewer than 500 employees, ultimate liability will still be determined under existing criminal and civil fraud laws, including the False Claims Act.

Railton said: "The CARES Act built a complex oversight system involving congressional agencies, special inspectors general, and more. The core takeaway is: heavy oversight, high audit risk, and potential referral to the Department of Justice." She added that the program allows businesses to apply for loans up to 2.5 times their average monthly payroll costs. If funds are received, as long as at least 75% is used to maintain employee wages and the rest for rent, utilities, and other compliant purposes, repayment is not required; otherwise, the loan must be repaid with interest.

As of early May, of the authorized $660 billion, approximately$125 billionremained available.

Necessity, Eligibility, and Exemptions

In practice, businesses with larger loan amounts will be the first to face scrutiny. Railton noted: "The $2 million threshold can serve as a reference benchmark for audit risk." The government is most likely to focus on the following three areas:

  • The reasonableness of the funds requested
  • Eligibility based on employee count
  • The decision to seek loan forgiveness rather than repay after receiving funds

She mentioned: "The Department of Justice has stated it will pursue applicants who misrepresent payroll costs, employee numbers, or the nature of their business." Federal prosecutors have already filed the first lawsuits under the program. In early May, the DOJ charged two individuals with attempting to obtain over $500,000 in loans for multiple businesses they operated, some of which did not exist and none of which had employees. Charges included conspiracy to commit fraud and conspiracy to commit bank fraud.

Rhode Island U.S. Attorney Aaron Weisman said in a statement: "Any attempt to steal funds from a program designed to help hardworking Americans keep their heads above water and pay their bills is unacceptable." His office brought the charges.

Enforcement Focus

Railton believes the False Claims Act is likely to be the primary legal basis for civil claims under the program. The law is broadly applied in cases involving federal funds and was a major source of litigation after the 2008 financial crisis and Hurricane Katrina. She said: "This is a focus area where we expect significant activity."

Under the law, whistleblowers (who can receive 30% of recovered amounts) file most lawsuits. Railton said: "Whistleblowers have incentives to bring such cases." She added that the Treasury Department is also expected to recover significant funds. "Over the years, we have seen these cases actively pursued." One reason whistleblowers play a key role is that the government has an obligation to investigate any allegations they raise, even if events occurred 10 years ago. This means that long after applying, receiving, repaying, or obtaining forgiveness for a loan, businesses may still face fraud liability.

Risk Mitigation Measures

To reduce audit or whistleblower risk, businesses should document their decision-making process when applying for the loan—including why they believed economic necessity existed—and include dissenting views. In the necessity determination, they should explain why they did not use available alternative sources of funding.

Railton noted: "This involves some practical considerations: if you use a certain type of credit line, will it affect future financing ability? If you use other sources now, will you be in trouble six months later? Are the terms for obtaining funds reasonable, or are they themselves harmful? If used, what impact would it have on the business? These assessments can be very specific. If you still believe the PPP loan is necessary, you should document the evaluation process and methodology. Detailed evaluation records will be very helpful."

Both companies and individuals may face liability. If you are the CFO responsible for filling out the application or leading the necessity calculation, you need to ensure the assessment is thorough. If you or others believe the loan is not necessary, but the board or other leadership holds the opposite view, those concerns should be included in the documentation.

Railton advised: "Pay attention to dissenters, whether from the board or within the company. If you hear questions about whether to apply for a PPP loan, take them seriously." Although companies can provide indemnification agreements to protect executives and other decision-makers, such agreements ultimately cannot prevent government enforcement. She emphasized: "Private agreements cannot waive government enforcement authority. Trying to avoid government action risk by negotiating indemnification or advance payment of legal fees with an employer will not work."

She concluded that the key to avoiding liability lies in whether the necessity was based on good-faith calculations and whether documentation supports the decision. This applies not only to the necessity question but also to employee count eligibility and loan forgiveness eligibility.

"There is risk on both ends," she said. "Both the application process and the forgiveness process carry risk, with the latter still somewhat uncertain." The Small Business Administration (SBA), which manages the PPP, has said it will issue more guidance on the forgiveness process and additional certification requirements.

Safe Harbor Deadline

The loan program includes a safe harbor period—until mid-May—allowing companies to decide after receiving the loan that they do not need it and return the funds. Technically, the government can still pursue liability because fraud applies to the application act, not just fund usage. But in practice, if funds are returned, the priority for auditing the business drops significantly, especially when the loan is below the $2 million threshold.

Although the safe harbor addresses the "necessity" question, if a company is later found ineligible due to errors in employee count calculations, the government is likely to apply similar standards. Railton said: "If employee numbers are misreported in the application (e.g., claiming fewer than 500 when actually far exceeding that), there is still liability risk because the safe harbor is not a 'blanket exemption.' It only assumes the business acted in good faith regarding economic necessity, and that is just one part. But practically, returning funds can significantly reduce scrutiny and liability risk."

Bottom line: Unless there is intentional misrepresentation, as long as businesses document their necessity assessment and meet eligibility and forgiveness standards in good faith, they will be in a strong position in audits or litigation.