ComplianceCARES Act signed into law to counter COVID-19
The CARES Act passed on March 27, 2020—$2.2 trillion in pandemic relief including PPP loans, stimulus checks, and expanded unemployment. If you ran a business through COVID, you know this one. Lots of compliance strings attached.
Accuracy-reviewed by the editorial team
The CARES Act was signed into law on , authorizing $2.2 trillion in economic relief to blunt COVID-19 impacts. The law created direct stimulus payments to households, the Paycheck Protection Program (PPP), expanded unemployment insurance, health-system funding, and corporate liquidity backstops.
Finance, HR, and compliance teams must determine eligibility for PPP loans or tax credits, set up reporting for relief funds, and implement governance around workforce, liquidity, and disclosure decisions. Technology and risk leaders should prepare for rapid policy changes, audit trails on fund use, and heightened fraud risks.
Major provisions companies must track
Paycheck Protection Program (PPP). SBA-backed forgivable loans up to 2.5x average monthly payroll (capped at $10M) for eligible small businesses and certain nonprofits to retain employees. Loans can be forgiven if funds are used for payroll, rent, mortgage interest, or utilities with at least 75% (later revised to 60%) allocated to payroll within the covered period.
Economic Stabilization and Main Street lending. Treasury’s Exchange Stabilization Fund backstopped Federal Reserve facilities—Commercial Paper Funding Facility, Primary Dealer Credit Facility, Main Street Lending Program—to support credit markets and mid-sized employers. These programs introduced restrictions on stock buybacks, dividends, executive compensation, and required maintaining employment levels where feasible.
Employee retention credit and payroll tax relief. Eligible employers could claim a refundable payroll tax credit for retaining employees during COVID-19 disruptions and defer payment of the employer portion of Social Security taxes, subject to reconciliation deadlines.
Unemployment insurance expansion. The law added $600 per week in federal Pandemic Unemployment Compensation, extended benefit durations, and expanded coverage to gig workers and the self-employed.
Healthcare and public health funding. Hospitals, providers, and state public health agencies received funding for surge capacity, testing, and PPE procurement. Telehealth flexibilities expanded reimbursement and relaxed originating site restrictions.
Who is affected
Small and mid-sized businesses seeking liquidity can pursue PPP loans or Economic Injury Disaster Loans (EIDL). They must certify necessity in good faith, maintain documentation on payroll and eligible expenses, and comply with affiliation rules.
Larger employers accessing Federal Reserve or Treasury facilities face conditions on buybacks, dividends, executive pay caps, and employment levels. Treasury also gained oversight through the Special Inspector General for Pandemic Recovery.
Healthcare providers receive grants and Medicare add-on payments but must follow HHS reporting on fund use, patient impact, and adherence to conditions such as balance billing restrictions for COVID-19 patients.
Workers and HR teams must account for expanded unemployment eligibility, paid leave provisions under the FFCRA (separate law), and benefits coordination to avoid double-dipping.
Immediate action plan
1) Determine eligibility and apply. Confirm size standards, NAICS codes, and affiliation rules for PPP; prepare payroll reports, tax filings, and corporate governance resolutions required by lenders. For credit facilities, review term sheets, financial covenants, and attestation requirements.
2) Track fund usage and certifications. Establish segregated accounts and cost centers for PPP proceeds or grant funds. Maintain invoices, payroll records, and board minutes to support forgiveness applications and audits. Document the good-faith necessity certification with cash-flow forecasts and revenue impact analyzes.
3) Update policies and board oversight. Brief boards on restrictions tied to relief programs (dividends, buybacks, executive compensation caps). Adopt policies to enforce compliance and to manage conflicts of interest for insiders benefiting from relief programs.
4) Coordinate HR and payroll. Align HRIS and payroll systems to calculate full-time equivalent counts, wage levels, and rehire requirements to maximize forgiveness. Communicate with employees about retention plans, hazard pay, or furlough options.
5) Manage disclosures and reporting. Public companies should evaluate SEC disclosure obligations around liquidity, facility participation, and material risks. Healthcare entities must meet HHS reporting timelines for Provider Relief Funds and comply with balance-billing restrictions.
6) Prepare for audits and fraud controls. Implement internal controls to prevent duplicate applications, detect phishing or business email compromise targeting relief funds, and respond to inquiries from the SBA, Treasury, or the Pandemic Response Accountability Committee.
Operational readiness checklist
- Confirm PPP or credit facility eligibility; compile payroll, tax, and ownership documentation.
- Create separate ledgers for relief funds; record expenditures with supporting evidence for forgiveness or reporting.
- Implement board-approved policies addressing dividends, buybacks, and executive compensation limits tied to relief participation.
- Coordinate HR/payroll to track FTE counts and wage reductions for forgiveness calculations.
- Review contracts and covenants for restrictions triggered by new debt or grants.
- Enhance fraud monitoring for phishing, fake lenders, and invoice manipulation targeting relief proceeds.
- Monitor evolving SBA and Treasury guidance; adjust applications and compliance artifacts as needed.
Oversight and controls
Audit scrutiny. The CARES Act created the Pandemic Response Accountability Committee, the Congressional Oversight Commission, and the Special Inspector General for Pandemic Recovery to monitor fund use. PPP borrowers over $2 million were subject to SBA review, and public companies faced investor scrutiny over necessity certifications.
Reporting obligations. Providers receiving HHS relief funds had to submit quarterly reports on spending categories, lost revenue, and patient metrics. Organizations tapping Federal Reserve facilities were expected to maintain payroll levels when feasible and comply with public disclosures of participants.
Interplay with other programs. Companies needed to coordinate CARES Act relief with Families First Coronavirus Response Act paid leave credits and state-level grants to avoid double-counting wages or violating exclusivity rules. Tax teams had to track deferrals to ensure timely repayment of deferred employer Social Security contributions.
Ethics and reputational risk. Institutions accepting aid while executing layoffs, dividends, or executive bonuses faced reputational backlash and potential enforcement. Establishing board-approved guardrails and stakeholder communication plans reduced controversy.
Sector-specific guidance
Financial institutions. Banks participating as PPP lenders had to implement Know Your Customer controls, Bank Secrecy Act monitoring for fraud, and rapid onboarding processes, while adhering to SBA underwriting standards and reporting timelines.
Higher education and nonprofits. Institutions accessing relief through Education Stabilization Funds or PPP needed to segregate restricted funds, track student aid disbursements, and comply with certification requirements on workforce retention and use of funds.
State and local governments. Coronavirus Relief Fund recipients had to document eligible expenditures (public health, payroll for public safety, economic support) and return unspent funds by statutory deadlines. Internal auditors should validate procurement and grant processes against federal guidance.
The Human Story Behind the Numbers
Behind every provision of the CARES Act was a real-world problem that needed solving—fast. Small business owners wondering if they'd make payroll. Hospitals overwhelmed with patients. Families facing sudden unemployment.
What made the CARES Act unprecedented was not just its $2 trillion price tag—it was the speed. Normally, federal programs take months or years to implement. This time, money was flowing within weeks.
Lessons That Still Apply Today
The CARES Act taught us something important: preparation matters more than you think. Organizations with strong financial management and clear documentation accessed relief programs faster than those scrambling for paperwork.
For business leaders, the takeaway is clear: build resilience before you need it. That means maintaining clean financial records, understanding cash flow, and having contingency plans ready.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
ESG Assurance Operating Guide
Deploy credible ESG assurance across CSRD, SEC climate disclosure, and ISSA 5000 requirements with regulator-aligned controls, data governance, and audit-ready evidence.
Coverage intelligence
- Published
- Coverage pillar
- Compliance
- Source credibility
- 91/100 — high confidence
- Topics
- COVID-19 · fiscal stimulus · PPP · unemployment · liquidity
- Sources cited
- 3 sources (congress.gov, home.treasury.gov, sba.gov)
- Reading time
- 6 min
Further reading
- CARES Act — Congress.gov
- Treasury Guidance — Treasury
- SBA PPP — SBA
Comments
Community
We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.
No approved comments yet. Add the first perspective.