PPP Loan Data Due Diligence: Target Evidence and Limits

Executive Summary

PPP loan data due diligence should begin with a limited claim: a dated federal lending record may supply a historical borrower identity, industry, or location lead. It is not a current company profile. The Paycheck Protection Program (PPP) ended on May 31, 2021. SBA limits forgiveness applications to five years from the date it issued the SBA loan number. ^[1] The Small Business Administration (SBA) describes its current Freedom of Information Act (FOIA) dataset as covering all disbursed PPP loans; its landing page was last modified October 21, 2024. ^[2] Neither date establishes when a particular company was last observed operating.

The central control is a field-to-claim protocol: preserve the original row, attach the dictionary used, resolve the borrower to a legal entity, and state the historical scope of every accepted answer. The current dictionary defines DateApproved as “Loan Funded Date”, JobsReported as “Number of Employees”, and ForgivenessDate as “Forgiveness Paid Date.” These definitions require careful treatment rather than interpretations based on column names alone. ^[3] The Government Accountability Office (GAO) says applicants self-certified their information and that PPP data reliability depends on the accuracy of applicant inputs supplied to lenders and SBA. ^[4] Its assessment of sufficient reliability concerned describing program participation, not validating every borrower for an acquisition mandate. ^[4]

Version differences also matter. ProPublica displays an update label of October 27, 2024, while its data footer describes lender-approved records as of June 1, 2021; its FAQ warns that some applications do not result in loans. ^{[5] [6]} These statements should be preserved separately from SBA's disbursed-loan scope. For identity reconciliation, use jurisdiction-qualified registry identifiers and documented name links. California defines its entity number as a registration identifier, while Florida warns that fictitious-name registration does not prevent someone else using the same name. ^{[7] [8]}

The resulting screening decision should be accepted historical match, escalated conflict, or unresolved identity. Acceptance authorizes only the historical claim reviewed. Current headcount, ownership, operations, profitability, distress, and sale interest require separate, current evidence. The historical self-reporting basis is the reason for that restriction. ^[9] Aggregate employment statistics cannot fill that gap: the Bureau of Labor Statistics (BLS) describes broad employment coverage but does not release an individual company's employee count through its Quarterly Census of Employment and Wages (QCEW). ^[10] This report supplies a reusable matrix and worksheet, with a fictional reconciliation example, to keep those limits visible throughout origination research.

Introduction and Background

PPP records still appear when an analyst researches a privately held U.S. business. The useful question is not simply whether a borrower name can be found. It is which claim the located record can support, for which entity, and at which date. The program was established by the Coronavirus Aid, Relief, and Economic Security (CARES) Act; its payroll-support purpose and historical end date belong in the evidence record. ^{[11] [1]}

For private equity (PE) origination, that record may open a research path. An unfamiliar borrower name can suggest a registry search; an address can identify a jurisdiction; an industry code can suggest adjacent businesses to examine. Those are discovery uses. Promoting the row into a present-day investment screen requires another evidentiary step, particularly because program information includes borrower self-reports. A Federal Reserve Bank of Boston working paper describes borrower-provided information in its PPP extract, and the Federal Reserve Bank of Dallas explains that self-reports can create incomplete or inconsistent information. ^{[12] [9]}

A practical starting question is: “Can this historical borrower be linked to the company under review?” Answer that before asking whether the company meets a current mandate. New York's registry describes exact entity names and Department of State (DOS) identifiers; California separately defines entity identifiers and address fields. ^{[13] [7]} The combination is more useful than a name match alone, but it still needs jurisdiction-specific interpretation.

The scope here is deliberately narrower than a general company-data guide. It covers program provenance, row semantics, entity reconciliation, historical dates, and permissible acquisition-research claims. Docket describes its research model as retaining a source, supporting excerpt, and collection date for researched answers. Applied to PPP, that approach requires retention of the row and dictionary, together with a separate record of the analyst's interpretation. It does not turn a program input into verified current headcount. GAO's account of self-certification supplies the reason for that distinction. ^[4]

Key Changes in How PPP Records Should Be Used

From borrower lookup to a dated evidence claim

The recommended process changes the unit of analysis from a search result to a specific claim. A lookup interface can help locate a candidate; it cannot decide whether that candidate is the legal entity behind a present-day brand. Florida's fictitious-name guidance demonstrates why: a trading name can be registered without exclusive rights to that name. ^[8] New York separately requires assumed-name filings for specified entity types conducting activities under a name other than their true legal name. ^[13]

An acceptable output therefore reads: “The identified historical loan row is linked to this registered entity through these retained documents.” It should not read: “This company currently has the employee count shown in PPP.” GAO explains that the jobs field came from applications asking for employee numbers, and Dallas Fed describes the self-reporting chain through lenders. ^{[14] [9]}

From column labels to version-specific definitions

Historical terminology can change. GAO reported that SBA changed the field previously labeled jobs retained to jobs reported in its program data. ^[14] That matters because “retained” can imply a measured outcome, whereas an application input supplies a different kind of evidence. The report's recommendation is to retain the raw field label alongside the dictionary definition and the analyst's permitted interpretation.

Record-state terminology also needs its own context. SBA's current release description says disbursed loans; ProPublica's FAQ describes approved applications that may not become actual loans. ^{[2] [6]} An analyst should not combine these descriptions into a universal statement that every searchable historical application was funded. Where a screen depends on receipt of funds, reconcile the official version and the record-specific fields before accepting the answer.

From silent merging to reviewable relationships

A second record for the same borrower need not be an accidental duplicate. Treasury's reopening announcement explains that certain existing borrowers became eligible for a Second Draw loan. ^[15] Preserve each loan record and link it to an adjudicated entity rather than collapsing the loan history into one row.

The recommended relationship structure separates:

• Loan identity: the source's loan identifier and unchanged raw row.
• Legal identity: jurisdiction, registry identifier, and supporting filings.
• Trading identity: borrower name, assumed name, brand, and website links.
• Research claim: the dated conclusion accepted by a reviewer.

This distinction follows the World Wide Web Consortium (W3C) provenance model's separation of entities, activities, and responsible participants. ^[16] It also keeps a transformation, such as name normalization, distinct from evidence that the resulting records concern the same business. W3C defines derivation as a transformation or construction based on a pre-existing entity; retaining that relationship makes subsequent corrections easier to trace. ^[16]

Data Provenance, Versions, and Record States

Preserve the release before interpreting the borrower

Start from the official SBA landing page and its linked dictionary. The page describes all disbursed PPP loans and displays its modification date. ^[2] During this review, the linked resources included PPP Data Dictionary.xlsx, public_150k_plus_240930.csv, and numbered public_up_to_150k CSV resources carrying the same 240930 suffix. Treat those names as version labels to preserve, not as proof that every row describes company conditions on a single date. ^[2]

The recommended retention manifest includes:

• Origin: publisher, landing URL, and direct resource URL.
• Version: literal filename, file checksum, and dictionary copy.
• Collection: download timestamp and analyst or process identifier.
• Record: loan identifier, source row location, and original values.
• Transformation: parsing, normalization, and matching rules applied.
• Review: accepted claim, conflicts, disposition, and reviewer date.

These are proposed research controls, not additional SBA columns. W3C's provenance definition supports recording the relationship between data and the activity that produced or transformed it. ^[16] A page access date proves when research occurred; it does not replace the loan's event dates.

Keep official scope and mirror scope separate

Table 1 compares evidence routes. It includes a research-service row because sourced target research is a separate delivery layer, rather than a replacement federal dataset.

The table distinguishes data origin, search interface, legal record, and research delivery. A mirror and the official release are not independent confirmations of a borrower fact when the mirror derives from SBA. ProPublica identifies the underlying lender-approved program records in its data footer. ^[5] Preserve any discrepancy rather than silently preferring whichever wording looks more conclusive. ProPublica's explicit application warning makes that distinction operationally important. ^[6]

Separate applications, amounts, and administrative events

The current dictionary defines DateApproved as Loan Funded Date, InitialApprovalAmount as the approval amount at origination, and CurrentApprovalAmount as the current approval amount. It separately lists UndisbursedAmount, ForgivenessAmount, and a forgiveness paid date. Its terse definitions do not supply a complete cash-flow reconciliation formula or comprehensive cancellation codebook. ^[3]

Accordingly, do not automatically calculate “cash received” as approval amount minus undisbursed amount. Preserve those fields separately and seek record-specific documentation if cash receipt is material to a diligence question. Forgiveness application and payment also differ: SBA describes deferral until it remits a forgiveness amount to the lender, while FDIC's historical notice describes forgiveness as conditional on criteria being met. ^{[1] [17]}

Cancellation needs the same version discipline. GAO's historical analysis used a fully canceled status in its dataset. ^[14] That does not establish that the current disbursed-loan release contains a complete population of canceled applications. Do not invent a CancellationDate column or infer cancellation from a missing forgiveness value.

Field-to-Claim Matrix for Acquisition Research

A field is useful only when its definition, source type, and reference date fit the question. Borrower names, addresses, industry inputs, and reported employment appear in borrower-provided PPP information described by the Boston Fed's research extract. ^[12] The official dictionary supplies field definitions; Census supplies the statistical meaning of the North American Industry Classification System (NAICS). ^[18]

Table 2 is a reusable field-to-claim matrix. “Historical program” means the applicable loan or application context, not the page-access date. The permissible claims are this report's recommended interpretations, conditional on successful identity reconciliation.

The matrix deliberately limits claims to what the record says. A legal-entity match does not improve the employee input's measurement quality or make its date current. The field originated in an application employee report. ^[14] Dallas Fed's discussion of self-reported information and GAO's input-dependence assessment support that distinction. ^{[9] [4]} Treat field acceptance and entity acceptance as separate review decisions. An exact registry name and identifier answer a narrower identity question. ^[13]

For reuse, export this table with the column headings intact and add source file/version, dictionary URL, applicable event date, corroborating document URL, and review decision to each row. The saved matrix should travel with the batch rather than remain a general policy detached from its actual files. The derivation record should explain how every displayed value was produced from retained source material. ^[16]

Implementation Considerations and Process Changes

Resolve the borrower before applying the mandate

Use the raw borrower name to generate candidates, not to authorize a match. California assigns a business entity number; New York publishes exact names and DOS identifiers; Florida's fictitious-name guide supports searches using an associated entity's charter or document number. ^{[7] [13] [19]} Pair each identifier with its jurisdiction and source, because these systems describe different registries. California also defines jurisdiction as the place under whose laws the entity was organized. ^[7]

The proposed matching sequence is:

• Preserve: retain the raw name, address, loan ID, and file version.
• Normalize: create additional search keys without replacing original values.
• Generate candidates: search official registries and relevant assumed-name records.
• Compare: assess legal name, address role, jurisdiction, dates, and name history.
• Link: use a filing or explicit company statement connecting the brand and entity.
• Review conflicts: record alternatives and reasons for accepting or rejecting them.
• Decide: accept the historical link, escalate a conflict, or leave identity unresolved.
• Research current fields: begin mandate screening from fresh, field-appropriate evidence.

These steps are proposed controls, not a numerical confidence model. A distinctive name plus location may be suggestive; it is not a universal acceptance threshold. A legal-name or assumed-name record supplies a different level of support. ^[13] Florida explicitly allows the possibility of another registration using the same fictitious name. ^[8] Keep candidate collisions visible rather than inventing a matching probability.

Interpret the registry within its jurisdiction

Registry status is itself a defined field. New York says a domestic corporation or limited liability company (LLC) remains active until it dissolves. ^[13] Delaware's free search returns active and inactive entities, so appearance in results does not itself supply a current status determination. ^[20] California says a foreign entity's status applies to its California registration. ^[7] These distinctions prevent a registry lookup from becoming an unsupported finding about current operations.

Address matching needs similar care. California defines its entity address as executive office; that role differs from an address whose role is unspecified in the historical PPP row. ^[7] A shared address should prompt review of the match, but it does not independently prove common ownership. Even registry sources may lack the member details needed for an ownership answer. ^[13] When address roles or dates differ, preserve both observations and state whether the difference was resolved.

Additional identifiers can help where present. The Securities and Exchange Commission (SEC) uses a Central Index Key (CIK) for filers, while the Global Legal Entity Identifier Foundation (GLEIF) describes official names and registered addresses in Legal Entity Identifier (LEI) data. ^{[21] [22]} Do not treat absence from EDGAR, the SEC's filing system, as nonexistence; the SEC notes that not all companies offering stock must file electronically. ^[21]

Use a row reconciliation worksheet

Copy the following header into a CSV worksheet; create one observation per source loan row and version. Empty cells should remain empty until researched, with the reason recorded in review_note.

source_landing_url,source_resource_url,source_file,source_checksum,dictionary_version,retrieved_at,source_row,loan_number,borrower_raw,borrower_dba,borrower_address_raw,project_city,project_state,naics_raw,naics_vintage,date_approved_raw,processing_method,initial_approval_amount,current_approval_amount,undisbursed_amount,loan_status,loan_status_date,jobs_reported,forgiveness_amount,forgiveness_date,legal_entity_name,registry_jurisdiction,registry_id,matched_fields,conflicting_fields,corroborating_urls,applicable_reference_date,disposition,reviewed_at,review_note

This is a proposed worksheet schema, not the SBA's CSV header. It separates the loan row, the legal-entity crosswalk, and the review decision. W3C's provenance model provides the underlying logic: document the data and the activity responsible for producing its derivative research record. ^[16] Keep original and corrected observations available rather than rewriting the historical evidence. Identify the activity responsible for the derived record. ^[16]

Time Limits, Quality Controls, and Ethical Review

Historical employment is not a current staffing measure

PPP employee information requires both measurement and time controls. GAO explains that applicants reported employee numbers, while its historical review found that employment-related fields could differ. ^[14] A newer file may improve an administrative value without converting an old employee input into a contemporary count. The origin remains borrower reporting in the historical extract. ^[12] GAO also explains that lenders could update or supplement information during disbursement reporting and forgiveness. ^[14]

This report recommends explicit restrictions:

• Headcount: require a fresh employee measure and a defined entity or group scope.
• Location: require current operating evidence, distinguishing offices from agents and mail addresses.
• Ownership: require current, entity-specific ownership evidence, not loan or lender identity.
• Financial health: require financial documentation appropriate to the question.
• Sale interest: require direct current evidence of willingness to engage.

The registry cannot fill every gap. New York says it does not maintain the LLC member or manager details described in its FAQ. ^[13] GLEIF reference data can support identity, but historical and current LEI records must be distinguished when used for a dated match. ^[22] An ownership question should remain unanswered when the available source only establishes a name and address. GLEIF distinguishes official-name and registered-address information as identity data. ^[22]

Review missingness, revisions, and collisions without allegations

GAO's reliability procedures examined frequencies, blanks, zero values, and extremes. ^[4] A target-research quality pass can adopt that diagnostic approach while avoiding a conclusion that unusual values establish misconduct. Missing employment, repeated names, or inconsistent addresses are review triggers, not findings about an identifiable borrower's behavior. Incomplete self-reported information is a documented data limitation. ^[9]

Recommended checks include:

• Missingness: separate blank, zero, unavailable, and not-applicable states.
• Parsing: preserve ZIP codes and identifiers as strings where necessary.
• Revision: compare the same loan identifier across retained file versions.
• Draw history: distinguish legitimate multiple loan records from duplicate ingestion.
• Collision: group normalized names and locations without automatically merging entities.

Treasury's Second Draw explanation supplies a concrete reason to preserve multiple records for the same borrower. ^[15] If an official revision changes a cited value, create a new observation and record whether the accepted claim also changes. If a mirror differs, prefer the appropriate official version for the program claim while retaining the mirror discrepancy. ^[2]

Minimize sensitive exposure

SBA's program included sole proprietors, independent contractors, and self-employed people, so a historical borrower record may relate closely to an individual. ^[1] Public availability does not make every address or identifying detail necessary for an acquisition-screening report. Use the minimum detail needed to establish the match, restrict raw evidence access, and avoid publishing real borrower examples in an educational workflow. This recommendation follows the FTC's need-based retention principle. ^[23]

The Federal Trade Commission (FTC) recommends retaining sensitive personally identifying information only while necessary and limiting employee access to resources needed for their work. ^[23] The National Institute of Standards and Technology (NIST) describes its Privacy Framework as a tool for identifying and managing privacy risk. ^[24] For this protocol, record the business purpose of retaining each sensitive field and use a retention policy appropriate to that purpose. Obtain professional advice where collection, reuse, or disclosure raises jurisdiction-specific questions; this article does not claim professional review.

Data Analysis and Evidence

What the available quantitative evidence does establish

A historical quality statistic is not a current accuracy score. GAO's September 2020 program analysis found missing or zero jobs-related entries for 18 percent of loans in the historical dataset it examined. ^[14] That is evidence about that extract and measure. It is not an estimated error rate for the current SBA release, a correction factor for an individual borrower, or a reason to scale every reported employee number downward. GAO's purpose-specific reliability assessment reinforces the need to define the analytical task before accepting the data. ^[4]

Time can be quantified without inventing a decay model. Use record age = research date minus the applicable event date, in calendar days. For this report's October 13, 2026 research date, a fictional event dated May 1, 2020 is 2,356 days old. This is an illustrative date-subtraction calculation, not an observed company statistic. Separately, the interval from the program end on May 31, 2021 is 1,961 days. ^[1] The interval from the landing-page modification on October 21, 2024 is 722 days. ^[2] These intervals measure different things; none establishes the freshness of company operations.

The proposed calculation controls are:

• Choose the field date: identify the event appropriate to the claim.
• State the research date: preserve when the calculation was made.
• Keep unknown dates unknown: do not substitute a download date for an absent event date.
• Label derived values: distinguish arithmetic from source-reported figures.
• Route current questions: obtain new evidence instead of applying an unsupported decay factor.

Use statistical denominators at their actual unit

County Business Patterns (CBP) provides annual statistics for businesses with paid employees, including employment during the week of March 12 and payroll measures. ^[25] Statistics of U.S. Businesses (SUSB) distinguishes a single-location establishment from a firm defined by establishments in the same geography and industry under common ownership or control. ^[26] It excludes nonemployer businesses. ^[26] Those scopes differ from PPP's eligible sole proprietors and self-employed borrowers. ^[1]

QCEW covers more than 95 percent of U.S. jobs, but its monthly measure refers to the pay period including the month's 12th day. ^[27] Its public geographic detail reaches county-industry aggregates; it does not release a particular company's employee count. ^[10] Broad coverage therefore supports sector context, not validation of a named target's payroll.

The Internal Revenue Service (IRS) publishes business statistics on income, deductions, taxes, and credits; its Integrated Business Dataset is assembled at the table level. ^[28] Such aggregates can inform a sector comparison, but they do not establish a target's revenue or profitability. Preserve industry vintage as well: Census's NAICS page lists proposed 2027 updates, which should not be treated as an already implemented replacement for the classification attached to an older record. ^[18]

Report reconciliation coverage as accepted, escalated, and unresolved rows, with a defined denominator. Keep loan-row coverage, legal-entity coverage, and current-mandate coverage separate. A reviewed historical loan count is not a count of operating acquisition targets.

Worked Reconciliation (Hypothetical Example)

The following names, identifiers, addresses, employee values, and amounts are entirely fictional. The purpose is to illustrate adjudication, not describe real borrowers or estimate program outcomes. The process preserves separate draw records because an existing borrower could be eligible for a second loan. ^[15]

Suppose a screening batch contains a first-draw row for “Harbor Tooling”, a second-draw row for “Harbor Tooling LLC”, and another row using the short name in the same city. The analyst generates a normalized-name-plus-location group. That group is a review queue, not an entity merge. Florida's warning about nonexclusive fictitious names explains why a shared trade name is insufficient by itself. ^[8]

Table 3 shows a fictional duplicate/collision group. Row labels are worksheet identifiers, not actual loan numbers.

The accepted outcome for A is deliberately narrow. The real program's jobs field came from applicants reporting employee counts. ^[14] It establishes the fictional historical entity link, not current employees, ownership, or readiness to sell. B requires additional evidence even though an analyst may suspect it is a second loan to the same business. C remains visible as a collision. Registry identifiers help adjudicate these paths, as New York's exact-name and DOS-ID guidance illustrates. ^[13]

For this three-row fictional batch, the outcome is one accepted, one escalated, and one unresolved row. The derived row-acceptance share is 1 divided by 3, or 33.3 percent, rounded to one decimal place. This calculation measures the example's reconciliation outcome only. It is not a measured match rate, an operating-company count, or a service-performance claim.

The reviewer should also record the specific unresolved request: “Obtain a filing or company statement connecting the borrower wording in B to the legal entity.” That is more actionable than an undifferentiated low-confidence label. Keep C's alternative candidate and conflicting address in the worksheet so subsequent research can resolve it without repeating the original search.

Implications and Future Directions

Use the matrix and worksheet to review historical inputs before researching current mandate fields. The self-certification and borrower-reporting findings support this sequence. ^{[4] [12]}

For a current identity question, start with the relevant registry and any legal-name history. For an operations question, seek current company materials and applicable official licensing or registration records. An active New York entity alone is insufficient because its status can persist until dissolution. ^[13] For employee scope, distinguish the operating entity from a group, full-time staff from other workers, and a reporting period from today's date. Aggregate QCEW data cannot supply an individual-company headcount. ^[10] For financial and ownership questions, retain the specific evidence needed or mark the answer unresolved.

A research system should support these independent review states:

• Historical row preserved: the original program evidence is available.
• Entity link reviewed: the borrower-to-entity relationship is accepted or pending.
• Field interpretation reviewed: the historical meaning is understood.
• Current mandate evidence collected: contemporary questions have separate support.
• Conflicts retained: unresolved alternatives remain visible at handoff.

These are recommended workflow states, not a certification or promised acquisition outcome. They make it possible to accept an identity link while declining a headcount inference. They also protect against confusing an administrative status date with a current observation. Delaware explicitly describes its status-as-of date as the date the entity entered that status, rather than the date an analyst searched. ^[29]

Future releases should be assessed for changed rows, changed definitions, and changed scope, separately. A dictionary revision may require reinterpretation without altering the underlying borrower identity; a corrected borrower string may require a new match review. W3C's derivation model provides a way to retain the connection between the old source, transformed records, and revised conclusions. ^[16] Better evidence management does not remove uncertainty; it makes the unresolved work specific and reviewable.

Frequently Asked Questions (FAQs)

Can PPP loan data be used for acquisition due diligence?

Yes, as historical discovery or corroboration evidence after entity reconciliation. SBA describes the official dataset as disbursed-loan data, while GAO's reliability assessment was tied to program-participation analysis. ^{[2] [4]} A record alone cannot answer current investment criteria. Separate origination screening from financial, legal, and commercial diligence, and obtain appropriate current documentation when a transaction question depends on it.

Does JobsReported show a company's current employee count?

No. The input belongs to the historical program context. GAO explains that applicants were asked to report employee numbers and documents the change from jobs retained to jobs reported. ^[14] Describe the recorded value with its period and scope; do not use it as today's workforce size or as proof of independently measured employment preservation.

Does a missing forgiveness amount mean the borrower still owes the loan?

The missing field does not establish that conclusion. Forgiveness application and remittance are distinct events in SBA's explanation. ^[1] Record the missingness and source version, then obtain appropriate current loan documentation if the obligation matters. Do not use a blank to infer distress or borrower conduct.

Are a PPP lookup and the SBA release interchangeable?

No. ProPublica's FAQ warns that some approved applications do not result in loans, whereas the current SBA landing page describes all disbursed loans. ^{[6] [2]} Preserve each source's own description and dates. A mirror is useful for discovery but does not supply independent corroboration of the underlying SBA record.

Does a borrower record establish the business is still active or independent?

No. PPP is historical, and registry activity has a jurisdiction-specific meaning. New York says a domestic corporation or LLC remains active until dissolution. ^[13] Verify current operations and ownership separately. Neither an old loan row nor an active registry status demonstrates a sale process or interest in acquisition outreach.

Conclusion

Retain a dated historical claim attached to a reconciled entity, with raw values, a file version, a dictionary, and a review decision. The historical borrower-reporting basis remains relevant after matching. ^[12]

The protocol separates the original loan record from the legal entity, the trading name, and the mandate answer. It also separates approval amounts, funding terminology, administrative status, and forgiveness payment. Those distinctions prevent a search interface, a familiar name, or a missing field from carrying more evidentiary weight than it can support.

Teams should preserve conflicts and publish coverage at the right unit. Accepted loan-row matches, accepted entity relationships, and completed current-mandate answers measure different work. Escalated and unresolved records belong in the review queue with explicit next steps. They should not disappear through automatic merging or become a generalized assessment of a borrower's character or financial condition. Documented incomplete inputs support careful review rather than expanded conclusions. ^[9]

For handoff, record each accepted claim, unresolved conflict, and specific evidence request. Keep the source row, entity link, and review decision together so the next reviewer can inspect and correct the file.