How S. 4952 Reopens COVID Relief Fraud Exposure

S. 4952 is still a pending bill, not enacted law. As of July 30, 2026, the Protecting American Taxpayers Act had been introduced in the Senate on July 13, 2026, placed on the Senate Legislative Calendar on July 14, 2026, and had not been signed into law.[1] That status matters. So does the calendar math.

If the placed-on-calendar text becomes law, Section 3302 would give the government and relators a 10-year limitations period for covered pandemic-era violations involving civil false-claim statutes and listed criminal fraud statutes.[2] For counsel who had been treating early PPP, EIDL, SVOG, or restaurant revitalization issues as aging toward a 2026 or 2027 limitations bar, the bill would move the file back onto the active-risk shelf.

This is not legal advice, and the bill may change. But exposure planning does not wait for the President’s signature. The first question for an in-house lawyer is not whether a client committed fraud. It is whether a claim, certification, forgiveness application, grant request, or supporting record remains reachable if Congress extends the clock.

What Section 3302 would change

Section 3302 is the operative provision for most civil exposure analysis. It would establish a 10-year limitations period for actions under 31 U.S.C. §§ 3729 and 3802 when the violation involves covered pandemic-era programs.[2] Section 3729 is the False Claims Act liability provision most counsel will recognize. Section 3802 belongs to the Program Fraud Civil Remedies Act, but in practice it still belongs in the same file review because it reaches false, fictitious, or fraudulent claims and statements made to federal agencies.

The bill also reaches criminal enforcement. The listed criminal statutes include 18 U.S.C. §§ 371, 641, 1001, 1028A, 1029, 1341, 1343, 1349, 1956, and 1957 when the offense involves a covered pandemic-era program.[2] That list brings in conspiracy, theft of government property, false statements, aggravated identity theft, access-device fraud, mail fraud, wire fraud, attempted or conspiracy fraud, and money laundering provisions. Civil FCA exposure and criminal exposure should therefore be tracked separately, even when the same loan file or grant application is the starting point.

The program language is broad enough to matter beyond PPP. The bill ties the extension to pandemic-era federal programs created or funded through statutes such as the CARES Act, the American Rescue Plan Act, the Consolidated Appropriations Act, 2021, and the Families First Coronavirus Response Act, including amendments to those laws.[2] That captures the familiar small-business relief programs, but it also requires counsel to look at the funding authority behind less obvious grants, advances, reimbursements, and subawards.

Why the 10-year clock is not just a longer version of the old analysis

Under the ordinary False Claims Act timing framework, counsel usually starts with 31 U.S.C. § 3731(b). One path is six years after the violation. The other allows suit within three years after the responsible United States official knew or reasonably should have known the material facts, subject to a 10-year outside limit.[4][5] That second path is the one that made the Supreme Court’s 2019 Cochise decision important.

In Cochise Consultancy, Inc. v. United States ex rel. Hunt, the Supreme Court held that the FCA’s government-knowledge limitations provision can apply in a non-intervened qui tam action.[4] The practical consequence was that a private relator could sometimes benefit from the government-knowledge timing rule even when the government declined to intervene. That did not mean every FCA case automatically had 10 years. It meant the limitations analysis had to ask who knew what, when an appropriate government official knew it, and whether the action remained within the outside limit.

Section 3302 would simplify that inquiry for covered pandemic matters in a way that favors reachability. Instead of litigating whether the six-year period applies or whether government-knowledge tolling saves a later-filed case, the statute would impose a 10-year period for the covered category.[2] That is why the bill should be treated as more than a technical amendment. It changes the first limitations memo a lawyer writes.

There will still be transition questions if the bill becomes law. Courts may have to decide how the new limitations language applies to cases filed around the effective date, to claims that defendants believed had already expired, or to conduct spanning more than one program phase. The safer planning assumption is narrower and more useful: do not rely on a prior six-year FCA conclusion for a pandemic-relief matter without testing whether S. 4952 would cover the funding source and the alleged violation.

How the window maps onto PPP, EIDL, SVOG, and restaurant grants

The exposure window depends on the date of the violation, not merely the program label. A false certification in an initial application, a later forgiveness submission, a draw request, a use-of-funds certification, or a supporting invoice can create different calendar dates. That distinction is the difference between a file that looks stale and a file that is still within a 10-year period.

The main pandemic programs fall into a relatively tight funding period. PPP funds were disbursed from March 2020 through May 2021; EIDL funds ran through July 2021; SVOG funds ran through August 2021; and restaurant revitalization grants ran through May 2022.[3] Under a simple disbursement-date view, a 10-year clock pushes those matters into roughly 2030 through 2032. Forgiveness, post-award certifications, or later statements can move the relevant date later if those statements are the alleged violation.

The last row is often where the uncomfortable call begins. Many organizations did not experience pandemic relief as one clean loan. A healthcare provider may have received multiple federal payments across different authorities. A nonprofit may have received a direct grant and a subaward. A contractor may have touched pandemic funds through a customer or prime contractor rather than through a direct application. Section 3302’s program-based language makes the funding source and statutory authority part of the limitations analysis.

Title II also matters for SVOG and restaurant revitalization grant files. The bill separately extends the limitations period to 10 years for fraud involving those programs.[2] Counsel should not assume those grants are secondary just because PPP generated more early attention. A grant file with a weak eligibility certification, missing revenue documentation, or inconsistent use-of-funds records can be just as calendar-sensitive.

What counts as the file to reopen

A limitations extension does not create liability by itself. It preserves the forum in which liability can be alleged. That distinction matters for legitimate recipients that applied under rushed pandemic conditions, followed shifting agency guidance, and may now be missing the employee, vendor, or bank records that explained the decision at the time.

The review should begin with the documents that would be exhibits, not with a generalized fraud-risk memo. For PPP, that usually means applications, payroll support, affiliation analysis, necessity certifications, forgiveness submissions, lender correspondence, and board or management materials discussing eligibility. For EIDL, it means application data, ownership information, employee counts, revenue figures, bank routing records, and use-of-proceeds materials. For SVOG and restaurant revitalization grants, it means eligibility calculations, revenue-loss support, expenditure records, certifications, and communications with the administering agency.

The preservation question is immediate. If a company’s retention schedule allowed pandemic-relief records to be destroyed after six or seven years, S. 4952 would make that schedule unsafe for covered matters if enacted. A document that would have aged out in 2026 may need a hold extension into 2030, 2031, or 2032. That is not because every recipient is suspect. It is because a limitations defense is only useful if the organization can first reconstruct the transaction accurately enough to evaluate it.

• Identify every pandemic-era funding stream, including indirect or pass-through funds.
• Record the statutory or program authority for each payment, not just the business name used internally.
• Separate initial applications, draw requests, forgiveness applications, certifications, and later agency communications by date.
• Check whether prior limitations assessments assumed a six-year FCA period without a pandemic-specific extension.
• Suspend destruction of potentially covered files until the bill’s status and any amendments are resolved.
• Track civil FCA exposure separately from criminal statutes and money-laundering theories.

The enforcement context explains the bill, but not its legal effect

Congress is not debating the limitations extension in a vacuum. Senator Grassley’s Q&A cites GAO estimates of $233 billion to $521 billion in annual federal fraud losses and $2.8 trillion in improper payments since 2003.[3] Those are enforcement-context numbers. They do not prove liability in any individual pandemic-relief file, and they do not answer whether a particular certification was knowingly false.

Senator Ernst’s office has framed S. 4952 as a major anti-fraud measure and has associated it with a projected $240 billion in savings, with support from outside groups.[6] That projection should be attributed as advocacy material unless and until there is an independent score or enacted statutory consequence tied to it. For legal planning, the important text is not the savings claim. It is the 10-year limitations language.

The kinds of conduct Congress has in mind are not hard to identify: false identities, shell entities, fabricated payroll, and knowingly false statements to obtain federal relief funds. The Elaine Escoe COVID relief fraud matter is the type of pandemic-era fraud story that makes a longer limitations period politically easy to defend. It should not become a shortcut for treating every relief recipient as a fraud defendant.

Civil FCA risk and criminal risk should not be merged

The same fact pattern can produce civil and criminal exposure, but the analysis is not interchangeable. A civil FCA matter may turn on falsity, materiality, scienter, damages, treble damages, penalties, relator dynamics, and agency knowledge. A criminal matter may turn on proof beyond a reasonable doubt, intent, identity, conspiracy, financial transactions, and whether prosecutors can tie funds to a charged offense.

S. 4952’s criminal list is broad enough to matter for more than application fraud. False statements under § 1001, mail and wire fraud under §§ 1341 and 1343, conspiracy under §§ 371 and 1349, identity-theft charges under § 1028A, and money-laundering statutes under §§ 1956 and 1957 all have different proof structures and different settlement pressures.[2] A company that is comfortable with its FCA merits analysis should still ask whether any individual, vendor, affiliate, or former employee created a separate criminal-fraud fact pattern.

The distinction also affects privilege and investigation design. A civil file review may be handled as a documentation and certification audit. A criminal-risk review may require closer attention to individual interviews, Upjohn warnings, device preservation, banking records, and possible conflicts between the organization and former officers or employees. The 10-year clock is common; the consequences are not.

Where prior advice is most likely to need a second look

The highest-risk legal memos are the ones that closed the file principally because time was running out. A 2025 or early-2026 assessment may have been reasonable under then-current assumptions: the transaction occurred in 2020, the six-year FCA period was nearing its end, and no tolling theory appeared likely. S. 4952 would not make that memo careless. It would make it incomplete if the bill becomes law in its current form.

Counsel should mark for review any matter with one or more of these features:

• A limitations conclusion tied to a 2020 or 2021 application date.
• A forgiveness, certification, or agency response date later than the initial disbursement.
• A prior decision not to investigate because the expected filing window was closing.
• A document-retention schedule that treats pandemic relief files like ordinary loan or grant records.
• A whistleblower complaint, hotline report, lender inquiry, SBA communication, or subpoena that was resolved informally but not fully documented.
• Any use of affiliates, management companies, payroll providers, staffing entities, or third-party preparers in the application process.

The point is not to relitigate every pandemic decision. It is to avoid having a revived limitations period expose a recordkeeping failure that could have been corrected while witnesses, emails, bank records, and agency correspondence were still available.

A practical triage sequence

The fastest useful review is a calendar-and-authority exercise. It can be done before anyone reaches a merits conclusion.

1. Build a funding inventory. List each pandemic-related loan, grant, advance, reimbursement, or subaward; the recipient entity; the amount received; the program; and the statutory authority if known.
2. Assign transaction dates. Capture application dates, approval dates, disbursement dates, forgiveness dates, certification dates, and any later agency communications.
3. Flag covered programs. Compare each funding stream against the pandemic-era laws and programs covered by the placed-on-calendar text.
4. Recalculate limitations exposure. Run both the old six-year assumption and the potential 10-year S. 4952 period so leadership can see what changes.
5. Preserve before judging. Extend litigation holds or retention holds for files that would fall within the new period if enacted.
6. Separate merits from timing. A matter can be timely and defensible, or stale under current law but reachable under S. 4952. Those are different risk statements.

For outside counsel, the client communication should be direct: the bill is pending, the text may change, and no liability conclusion follows from receipt of pandemic funds. But if the placed-on-calendar language becomes law, prior limitations assumptions for covered pandemic-era programs may no longer be reliable. That is enough to justify preservation and triage now.

For in-house counsel, the immediate risk is often internal. A business unit may believe the PPP or EIDL file closed years ago. Finance may have archived the grant records. HR may have changed payroll systems. The person who signed the certification may have left. A 10-year limitations period turns those ordinary post-pandemic facts into evidence-access problems.

The narrow bottom line

S. 4952 has not yet passed the Senate or become law. If enacted in its current placed-on-calendar form, Section 3302 would replace the ordinary FCA timing analysis for covered pandemic-era program violations with a 10-year clock and would also extend limitations periods for listed criminal fraud statutes tied to those programs.[2]

Counsel should treat the bill as an exposure-planning event, not as a liability finding. Identify covered funds, preserve records, revisit six-year limitations assumptions, and keep civil false-claim risk separate from criminal fraud risk. The entities most likely to be surprised are not necessarily the ones with the worst facts. They are the ones that let the calendar close the file before Congress finished moving the deadline.

References

1. S. 4952 - Protecting American Taxpayers Act, Congress.gov, July 13, 2026
2. S. 4952, Protecting American Taxpayers Act, GovInfo
3. Q&A: Protecting American Taxpayers Act, Senator Chuck Grassley
4. High Court Applies Government-Knowledge Statute of Limitations to Private FCA Suits, Consumer Financial Services Law Monitor
5. False Claims Act Fundamentals: Statute of Limitations, Inside the False Claims Act
6. Ernst Delivers Fraudsters’ Day of Reckoning to the Senate Floor, Senator Joni Ernst