The Paycheck Protection Program (PPP) officially ended years ago, but the compliance responsibilities tied to PPP lending have not. Banks, credit unions, fintech lenders, and other SBA-approved lenders may still need to respond to audits, investigations, litigation requests, or SBA reviews related to loans issued during the pandemic.
Updated guidance and extended statutes of limitations have made PPP loan record retention even more important for lenders. Financial institutions that processed large volumes of PPP loans now face ongoing operational and compliance challenges tied to storing, organizing, and retrieving loan documentation years after disbursement and forgiveness.
For many lenders, this has accelerated investments in secure document management, cloud storage, records digitization, and long-term records retention strategies.
This guide explains current PPP loan record retention requirements for lenders, how guidance has changed, what documents institutions should maintain, and how SBA lenders can improve long-term compliance readiness.
Paycheck Protection Program (PPP) Refresh
The Paycheck Protection Program was established under the CARES Act in 2020 to help businesses continue paying employees and covering approved operational expenses during the COVID-19 pandemic.
The Small Business Administration (SBA) administered the program with support from participating lenders across the country. PPP lending expanded beyond traditional SBA loan lenders and included:
- Federally insured banks
- Credit unions
- Farm Credit System institutions
- Approved non-bank lenders
- Financial technology lenders
To speed up funding during the crisis, the SBA granted delegated authority to participating lenders and streamlined underwriting procedures through interim final rules and ongoing FAQ guidance.
Under PPP lending requirements, lenders generally needed to:
- verify borrower certifications
- confirm payroll documentation
- review average monthly payroll calculations
- follow Bank Secrecy Act requirements
- process forgiveness applications
- maintain supporting loan records
Although PPP lending has ended, lenders are still responsible for retaining loan documentation tied to these transactions.
What Are the Record Retention Requirements for PPP Loans?
PPP lenders are generally required to retain loan documentation for at least six years after the loan is forgiven or repaid in full. However, recent enforcement trends and updated federal guidance have caused many institutions to reassess retention timelines.
Earlier SBA guidance focused primarily on maintaining borrower applications, payroll verification documents, forgiveness documentation, underwriting records, and servicing records.
More recent guidance and fraud enforcement activity have increased attention on audit readiness, fraud investigations, litigation holds, and long-term compliance retention. As a result, many lenders now maintain PPP loan documents longer than the original minimum guidance.
Previous PPP Guidance for Lenders
Under earlier PPP guidance, lenders typically retained records for six years after forgiveness or repayment. The SBA’s interim final rules required lenders to preserve documentation supporting loan origination and forgiveness decisions.
Because lenders were permitted to rely heavily on borrower certifications, institutions often focused retention efforts on payroll verification, borrower eligibility documentation, certifications, forgiveness approvals, and loan servicing records. At the time, many lenders treated PPP retention similarly to other SBA loan program retention requirements.
Updated Interim Final Rule and Extended Statute of Limitations
The legal and enforcement landscape surrounding PPP loans changed significantly after the initial rollout period. Federal agencies, including the Department of Justice (DOJ), the SBA Office of Inspector General, the FBI, and the COVID-19 Fraud Enforcement Task Force continue investigating PPP fraud cases years after loans were issued.
The statute of limitations for certain COVID-19-related fraud offenses was extended to 10 years under federal law. This dramatically increased the potential lifespan of PPP-related investigations and document requests.
Because of this extended fraud statute of limitations, lenders may still receive requests tied to underwriting records, borrower certifications, suspicious activity documentation, forgiveness reviews, and communications and servicing records. This is one reason many institutions now maintain PPP loan documents beyond the earlier six-year benchmark.
How Long Should Lenders Keep PPP Loan Documents?
There is no single universal retention schedule that applies to every lender. Retention timelines may depend on:
- institutional policies
- regulatory obligations
- legal hold requirements
- state laws
- litigation exposure
- fraud investigation risk
However, many compliance professionals now recommend retaining PPP loan documentation for at least 10 years because of the expanded federal statute of limitations tied to pandemic fraud investigations.
For SBA lenders, retaining records longer may help support audit preparedness, regulatory examinations, litigation defense, fraud investigations, and internal compliance reviews. Institutions should also consult legal counsel and compliance teams when determining final retention schedules.
PPP Loan Documents Lenders Should Retain
PPP lenders may need to maintain both digital and physical records tied to loan origination, servicing, forgiveness, and compliance workflows.
Common PPP Loan Records for Lenders
| Document Type | Examples | Why It Matters |
| Borrower applications | PPP borrower application forms, certifications, ownership disclosures | Supports eligibility verification |
| Payroll documentation | Payroll reports, IRS filings, tax forms | Verifies loan calculations |
| Forgiveness records | Forgiveness applications, approval decisions, expense documentation | Supports forgiveness determinations |
| Underwriting records | Internal review notes, approval workflows, quality control checks | Demonstrates lender due diligence |
| Compliance documentation | BSA/AML reviews, KYC records, suspicious activity documentation | Supports regulatory compliance |
| Communications | Borrower emails, servicing correspondence, internal communications | Useful during audits or investigations |
| Servicing records | Payment records, deferment records, servicing actions | Documents loan lifecycle activity |
How SBA Lenders Can Maintain Compliant PPP Loan Documents
Maintaining accessible and organized PPP records can become difficult for institutions managing large volumes of files across multiple systems and departments. Many lenders are modernizing records management practices to improve accessibility and reduce operational risk.
Digitize Legacy PPP Files
Some lenders still maintain hybrid systems that combine paper loan files with digital records.
Document scanning and digitization can help improve retrieval speed, support remote access, simplify audits, reduce physical storage requirements, and improve disaster recovery readiness.
Use Secure Cloud Storage and Document Management Systems
Many lenders are also moving PPP records into centralized digital repositories with stronger security controls. Secure document management systems may support role-based access controls, audit logs, encrypted storage, automated retention policies, and secure backup workflows.
Store Physical Records Securely Offsite
Some institutions continue retaining physical PPP loan records for operational or legal reasons. Secure offsite storage can help protect records from environmental damage, theft, accidental destruction, and unauthorized access.
PPP Audits and Investigations Are Still Ongoing
One common misconception is that PPP oversight ended when the program closed. In reality, federal agencies continue pursuing investigations tied to alleged fraud, false certifications, misuse of funds, identity theft, and inflated payroll claims.
Even lenders that followed PPP guidance carefully may still receive document requests tied to investigations or SBA reviews. Maintaining complete and organized loan records can help institutions respond more efficiently if records are requested years after origination or forgiveness.
How Record Nations Can Help
Managing long-term PPP loan retention requirements can become difficult for institutions handling thousands of records across multiple locations and systems.
Record Nations helps connect organizations with secure records management providers nationwide for:
- document scanning
- secure document storage
- cloud storage
- records digitization
- document management systems
- backup storage solutions
Our network providers can help lenders improve records accessibility, strengthen secure records management practices, and support long-term compliance retention needs.
Whether your institution needs help digitizing legacy PPP loan files or implementing secure offsite storage for sensitive financial records, Record Nations can help connect you with providers that fit your operational requirements. To get started, request free quotes today or call (866) 385-3706.
