You Got a Civil Investigative Demand (CID) About Your Paycheck Protection Program (PPP) Loan under the False Claims Act (FCA) – Here’s What the CID Means

If your business just received a Civil Investigative Demand — usually called a “CID” — from the Department of Justice about a PPP loan you got back in 2020 or 2021, you’re not alone. Years after the Paycheck Protection Program wound down, the federal government is still actively investigating whether businesses were really eligible for the money they received. This post explains what’s going on, in plain English, and what to do next.

Why is this happening years later?

The Paycheck Protection Program moved fast in 2020. Loans went out the door in days, sometimes hours, with limited upfront verification. Now the government is looking backward, and it has a long runway to do it: claims under the False Claims Act can generally be pursued for up to 10 years. That means loans from 2020 remain fair game into 2030, and loans from 2021 stay exposed even longer.

The Department of Justice has made pandemic-relief fraud an ongoing enforcement priority, not a closed chapter. In fiscal year 2025, the DOJ recovered more money under the False Claims Act than in any year in the statute’s history, and pandemic relief programs were specifically called out as an area of focus. In April 2026, DOJ stood up a National Fraud Enforcement Division, which signals more resources aimed at exactly these cases, not fewer.

Nonprofits, in particular, are seeing a wave of these letters recently.

There’s also a structural reason PPP cases keep surfacing: the loan data is public. Loan amounts, business names, and owner information were published, which makes it easy for outside parties — including “relators” who can file suit and share in any recovery — to comb through the data and flag businesses that look ineligible on paper. The relators use Artificial Intelligence (AI) to identify and whistleblow in Qui Tam lawsuits filed under seal and civilly prosecuted by the Department of Justice (DOJ) and the U.S. Attorney’s (AUSA) Offices. 

What a CID actually is (and isn’t)

A Civil Investigative Demand is not a lawsuit, and it’s not a criminal charge. It’s a formal request for documents, information, or testimony that DOJ can send while it’s still deciding whether a case is worth pursuing. Think of it as the investigation stage, not the trial stage.

That said, it’s a serious document. It typically comes with:

• Document requests — often broad, covering loan applications, payroll records, employee counts, and forgiveness paperwork
• Interrogatories — written questions you must answer under oath
• A deadline — usually short, and missing it can create its own problems

What a CID means in practice is that someone — a government auditor, a data-mining relator, or a whistleblower — has flagged your loan as potentially involving a false certification: about employee headcount, affiliation with other companies, necessity of the funds, or how forgiveness money was actually spent.

What’s actually at stake with the False Claims Act

The False Claims Act carries real financial teeth and can turn into a criminal case. If the government determines a business submitted a false claim, exposure typically includes:

• Treble damages — three times the amount of the loan or forgiveness at issue
• Per-claim penalties on top of that, assessed for each false certification
• In some cases, referral for criminal investigation, particularly where there’s evidence of intentional misrepresentation rather than a good-faith error. 

The critical distinction the government is supposed to draw — and the one your defense should lean on — is between an honest mistake and a knowing false statement. PPP eligibility rules changed multiple times during 2020 and 2021, guidance was inconsistent, and plenty of businesses relied in good faith on what their lender or professional told them at the time. That history matters.

What to do if you receive a CID

1. Don’t respond on your own, and don’t ignore it. Both instinctive reactions — over-explaining to the investigator or hoping it goes away — tend to make things worse. Get an attorney with False Claims Act experience involved before you send anything back.
2. Preserve everything now. Loan applications, payroll records, emails with your lender, forgiveness applications, communications with your professional — anything touching the loan. Evidence and institutional memory fade fast on a program that’s now five-plus years in the rearview mirror, and gaps get read against you.
3. Resist the urge to “just clear it up” informally. Statements made casually to an investigator, even ones meant to be helpful, can become part of the record. Everything should go through counsel.
4. Know that CIDs can be pushed back on. You generally have the right to object to requests that are overly broad, unduly burdensome, or that reach beyond the legitimate scope of the investigation. Negotiating the scope of a CID is a normal, expected part of the process — it isn’t obstruction, and experienced counsel does this routinely.
5. Start building your good-faith narrative early. If your eligibility certifications were reasonable given the guidance available at the time, or if errors were the product of confusing rules rather than intent to deceive, that story needs to be documented and told clearly and consistently from the outset.

The bottom line in a  FCA PPP CID investigation 

Receiving a CID is unsettling, but it’s a starting point for a conversation with the government, not a verdict. The businesses that come out of these investigations in the best position are the ones that get experienced counsel involved immediately, preserve their records, and respond in a coordinated, documented way rather than reacting piecemeal.

Contact Josh Ungerman with any questions on False Claim Act Paycheck Protection Program investigations at 214-749-2427 or jungerman@meadowscollier.com.