Federal False Claims Act Defense: For CEOs & Companies Facing Civil and Criminal Exposure

False Claims Act Defense Strategies: A CEO’s Road Map From Civil Investigation to Criminal Charges

By Theodore P. Watson, Practice Leader US  Supreme Court Admitted Attorney, Watson & Associates LLC  |  Updated September 26, 2026  |  12-minute read

A civil investigative demand arrived at your company. Or an agent left a business card with your controller. Or a former employee’s lawyer sent a litigation-hold letter, and nobody on your team knows what the government already has. Right now you are trying to answer three questions: Is this civil or criminal? How exposed am I personally? What should we do, and not do, this week?

The short answer. If you are defending a federal False Claims Act case, it means that you are fighting on up to two tracks at once. The civil case (31 U.S.C. § 3729) is about money: treble damages plus $14,308 to $28,619 per claim. The criminal case (18 U.S.C. § 287 and related charges) is about prison. Most cases are shaped, and often decided, during the investigation, before any lawsuit or indictment is public. The road map below shows each stage and the defenses that matter there.

 

Speak with a former federal prosecutor today: 1 (866) 601-5518 On a confidential first call, we review what you received, walk through which track (civil, criminal, or both) the government’s first move points to, and identify what to hold off on until you have counsel. Download the free False Claims Act Defense Checklist   |   Book a confidential call online

Our team includes: a former AUSA in the Major Frauds Section (S.D. Cal.)    a former federal agency executive  ·  a former Navy judge advocate with contracting experience. We represent defendants in False Claims Act matters nationwide.

Who This Road Map Is Written For

This guide is for the people who sign the certifications and answer to the board: chief executives, owners, CFOs, general counsel, and compliance leaders. It is limited to three areas where federal fraud enforcement is most active in 2026. If one of these sounds like your week, keep reading.

Government contractors and procurement fraud

A DCAA audit finding that suddenly came with a CID. Questions about labor categories, time charging, or employee qualifications. A challenge to your small business, 8(a), SDVOSB, or HUBZone status. Country-of-origin (TAA) or cybersecurity (DFARS 252.204-7012 / CMMC) certifications a competitor or former employee says were false. A GSA pricing or defective-pricing question that used to be a contract dispute and is now being called fraud.

Healthcare companies and healthcare fraud

An HHS-OIG subpoena. A CMS payment suspension that froze your cash flow. Questions about medical necessity, coding levels, Medicare Advantage risk adjustment, or referral relationships under the Anti-Kickback Statute. Hospitals, laboratories, pharmacies, home health and hospice agencies, DME suppliers, behavioral health providers, and physician groups all see these.

PPP borrowers and pandemic-loan fraud

A letter from the SBA Office of Inspector General. A lender asking for records on a loan that was forgiven years ago. Questions about affiliation and size, headcount, payroll calculations, the “economic necessity” certification, or a second draw. Forgiveness did not close these files. Congress extended the limitations period for PPP fraud to ten years, and enforcement is accelerating (details below).

Is the False Claims Act Civil or Criminal?

Both, through different statutes. The False Claims Act itself, 31 U.S.C. §§ 3729–3733, is a civil statute. It carries no prison time. But the same conduct can be charged as a crime under 18 U.S.C. § 287 (false claims against the United States) and a list of companion statutes. The Department of Justice’s own policy (Justice Manual § 1-12.000) directs its civil and criminal lawyers to coordinate, so a company can face a civil investigation, a grand jury investigation, and an agency action all built on the same documents.

	Civil False Claims Act	Criminal false claims case
Main statute	31 U.S.C. § 3729	18 U.S.C. § 287, plus conspiracy, wire fraud, health care fraud, and others
Who brings it	DOJ Civil Division or U.S. Attorney, or a private whistleblower (relator) in a qui tam suit	Only federal prosecutors, usually through a grand jury
Mental state	“Knowingly”: actual knowledge, deliberate ignorance, or reckless disregard. No specific intent to defraud is required.	Generally proof of knowing, intentional conduct beyond a reasonable doubt; many fraud statutes require intent to defraud
Burden of proof	Preponderance of the evidence	Beyond a reasonable doubt
What is at stake	Treble damages + $14,308–$28,619 per claim; exclusion, suspension, debarment	Prison, fines, restitution, forfeiture, and all of the civil consequences
First sign you may see	Civil investigative demand (CID) or a relator complaint once unsealed	Grand jury subpoena, search warrant, agent visits to employees’ homes, target letter

 

For a plain-English primer on the statute itself, see our federal False Claims Act FAQ for CEOs and companies.

Why 2026 Is a Different Enforcement Environment

Executives often tell us their company has been audited before and nothing came of it. The numbers explain why this cycle feels different:

• Record civil recoveries. DOJ reported more than $6.8 billion in False Claims Act settlements and judgments for fiscal year 2025, the largest annual total in the statute’s history. More than $5.7 billion involved healthcare.
• Record whistleblower filings. Relators filed 1,297 new qui tam suits in FY 2025, up from the prior record of 980, while DOJ opened another 401 matters on its own. Most of your exposure starts with an insider, not an auditor.
• Whistleblower suits survived a major constitutional challenge. On September 1, 2026, the Eleventh Circuit held in United States ex rel. Zafirov v. Florida Medical Associates that qui tam relators are not “officers” under the Appointments Clause, reversing a district court that had struck the provisions down. Other constitutional arguments were sent back to the trial court, so this issue is not finished, but companies should not plan around qui tam suits disappearing.
• The largest healthcare takedown by defendant count. On June 23, 2026, DOJ announced charges against 455 defendants, including 90 licensed medical professionals, tied to more than $6.5 billion in alleged false claims. CMS separately suspended or revoked billing privileges for more than 2,400 providers.
• PPP enforcement is widening, not winding down. On September 14, 2026, the administration announced it would bar roughly 870,000 people suspected of pandemic-loan fraud from future federal loans, alongside a DOJ–SBA criminal enforcement effort called “Operation No Doze.” The ten-year limitations period means 2020 loans remain open to charges into 2030.
• Penalties did not drop. Because the 2026 inflation adjustment was canceled, the per-claim civil penalty remains $14,308 to $28,619. On 500 invoices, penalties alone can exceed $7 million before any damages are trebled.

We break down how those numbers compound in False Claims Act penalties for government contractors.

Part 1: The Civil False Claims Act Road Map

Most civil FCA cases move through five stages. The defense opportunities are different at each one, and the earliest stages are where the most can be done.

Stage 1: The sealed qui tam complaint (you usually don’t know yet)

A whistleblower files under seal in federal court and serves the complaint on DOJ, not on you. The statute provides a 60-day seal that the government routinely asks to extend, often for a year or more. Signs a sealed case may exist: a departing employee who raised compliance complaints, an unusual records request from an agency, or a competitor that seems to know details of your billing.

What you can do now: preserve documents, stop routine deletion for relevant custodians, and have counsel assess whether any issue should be investigated internally before the government arrives.

Stage 2: The investigation and the civil investigative demand

A CID can require documents, written answers, and sworn oral testimony. It is also a roadmap of the government’s theory: the date ranges, contracts, codes, or loan numbers it lists tell you where the relator pointed. This is where most FCA cases are effectively won, narrowed, or lost, because the government forms its view of scienter and damages from what it collects here.

What you can do now: negotiate scope and custodians, produce on a rolling basis through counsel, protect privilege, and prepare employees before any interview. Our guide to what CEOs must know right away about a CID walks through the first steps.

Stage 3: The intervention decision

Before the seal lifts, DOJ decides whether to intervene and take over the case. Intervention changes the odds significantly, which is why defense counsel often make a written or in-person presentation to the government before that decision. That presentation is built from Stage 2 work: the facts, the regulatory history, and the legal defenses below. More on how that decision is made: how DOJ decides whether to intervene in a qui tam case.

Stage 4: Unsealing and litigation

Once the complaint is unsealed and served, the company can move to dismiss. Common grounds include failure to plead fraud with particularity under Rule 9(b), the public-disclosure bar (31 U.S.C. § 3730(e)(4)), the first-to-file bar (§ 3730(b)(5)), and the statute of limitations (§ 3731(b): six years from the violation, or three years from when the responsible official knew or should have known, capped at ten). If the case survives, it moves through discovery, expert work on damages, and summary judgment.

Stage 5: Resolution and the business consequences

Most matters that are not dismissed resolve by settlement. DOJ’s policy on cooperation credit (Justice Manual § 4-4.112) can reduce the multiplier applied to damages when a company discloses, cooperates, and remediates. The settlement is only half of the resolution: healthcare companies may face a Corporate Integrity Agreement or exclusion from federal health programs, and contractors may face suspension or debarment. Those consequences should be negotiated at the same table, not after.

Key Defense Strategies in a False Claims Act Defense Case

Many online lists of False CLaims Act defenses read the same way: “no intent, no knowledge, good faith, no fraud.” Those ideas are right in spirit, but each one works differently in a civil case than in a criminal case, and one of them is often misunderstood. Here is how each defense actually operates, and where it tends to break down.

1. Lack of intent: False Claims Act defense is really about “knowledge”

In a criminal case, lack of intent to defraud can be a complete defense. In a civil FCA case, the statute says the opposite: no specific intent to defraud is required (31 U.S.C. § 3729(b)(1)(B)). The government only has to prove the company acted “knowingly,” which includes deliberate ignorance and reckless disregard.

That does not make the civil defense weak. In United States ex rel. Schutte v. SuperValu Inc. (2023), the Supreme Court held that scienter turns on what the defendant actually knew and believed at the time, not on what a hypothetical reasonable company might have thought. So the civil defense is built on contemporaneous evidence of your real understanding: emails, internal guidance, questions you asked the agency, and how you applied an ambiguous rule before anyone complained. Where it breaks down: internal warnings that were raised and not addressed. A good-faith story needs to survive the company’s own emails.

2. Lack of knowledge: who knew what, and when

For an executive, the personal question is whether you knew about conduct others carried out. For a company, the question is whose knowledge counts. Courts are not uniform on whether a company can be found to “know” something by combining facts held by different employees, so this defense depends on the circuit and on careful reconstruction of reporting lines. Where it breaks down: “I didn’t know” is weakest when red flags reached leadership and nobody followed up. That is exactly what “deliberate ignorance” and “reckless disregard” are designed to capture.

3. Good-faith reliance on the government or on counsel

Three versions of this defense come up regularly:

• Government direction or knowledge. If a contracting officer, program office, or CMS contractor told you to do it that way, or knew and kept paying, that evidence goes to both knowledge and materiality.
• Reliance on published guidance. Following agency guidance, FAQs, or a reasonable reading of an ambiguous regulation (as the SBA PPP rules changed repeatedly in 2020 and 2021).
• Advice of counsel. Relying on a lawyer’s advice can defeat knowledge, but asserting it usually waives attorney-client privilege on that subject, and it only works if the lawyer had the full facts. It is a decision to make deliberately, early, and with counsel who has seen how prosecutors test it.

4. No false claim: the claims were accurate

The simplest defense is often the strongest: the invoice, cost submission, bid, billing code, or loan application was true. Proving it requires reading the claim against the actual contract clauses, regulations, and payment rules in force at the time, which is where FCA defense overlaps with government contracts and healthcare regulatory work. Many allegations collapse once someone who knows how the contract was actually administered explains the documents.

5. Materiality: the defense most companies overlook

Not every rule violation is fraud. Under Universal Health Services v. United States ex rel. Escobar (2016), a misrepresentation must be material to the government’s payment decision, a standard the Court called “demanding.” The most powerful fact pattern: the government knew about the issue and kept paying. Building this defense means going into the agency’s own payment history, audit findings, and prior guidance.

6. Damages, causation, and procedural defenses

Even where liability is contested, the size of the case often is not settled. The government’s damages model may count claims that were not affected, ignore the value of goods or services actually delivered, or reach past the limitations period. Procedural defenses (Rule 9(b), public disclosure, first-to-file) can end a qui tam case early.

Defense	Civil FCA	Criminal case	Evidence that builds it
Lack of intent	Not required; focus is on “knowingly” and subjective belief (SuperValu)	Often a complete defense	Contemporaneous emails, guidance, questions posed to the agency
Lack of knowledge	Depends on who knew; circuits differ	Central to individual cases	Reporting lines, meeting records, escalation history
Good-faith reliance	Defeats knowledge; government knowledge also defeats materiality	Can negate willfulness	CO directions, agency guidance, counsel’s advice (privilege waiver risk)
No false claim	Complete defense	Complete defense	Contract clauses, regulations, billing rules in force at the time
Materiality	Required element (Escobar)	Required for most fraud statutes	Agency payment history, audits, prior disclosures

 

Not sure which of these defenses fits your facts? Most executives aren’t, early on. Call 1 (866) 601-5518 to talk it through confidentially with a former federal prosecutor.

Essential First Steps When Your Company Is Under Investigation

Retain counsel who focuses on False Claims Act defense before anyone talks to investigators

The first conversation with an agent or an AUSA is part of the record. So is the first production of documents. Retain counsel before either happens. When you evaluate firms, ask:

1. Who on the team has worked inside DOJ or a U.S. Attorney’s Office, and did they handle fraud cases specifically?
2. Has anyone on the team worked on the civil and the criminal side, so parallel exposure is assessed together?
3. Does the team understand the regulations behind your claims: the FAR and your contract clauses, Medicare and Medicaid billing rules, or the SBA PPP rules?
4. Does the firm also represent whistleblowers? If so, understand how conflicts are handled.
5. Who will actually do the work, and who will be your contact day-to-day?

Manage every government inquiry through counsel

An overbroad response to a CID or subpoena can create new exposure by handing the government documents outside the allegation. Counsel should negotiate scope, date ranges, and custodians; produce on a rolling basis; log privileged material; and put a written litigation hold in place. Destroying or altering records after an inquiry begins can be charged as obstruction under 18 U.S.C. § 1519, which carries up to 20 years, no matter how the fraud allegation turns out.

Perform financial and contract forensics under privilege

The facts behind the allegation should be rebuilt before the government rebuilds them for you. Forensic accountants and coding or contract specialists should be retained through counsel so their work is protected. What that review looks like depends on the sector:

• Government contracts: timecards and labor mapping, billing allocations across contracts, employee qualifications against labor categories, cost and pricing data, and subcontractor pass-throughs.
• Healthcare: statistically valid claim samples, documentation against coverage rules, coding patterns against peer data, and referral and compensation arrangements under the Anti-Kickback Statute and Stark law.
• PPP: affiliation and employee counts, the payroll calculation, use of proceeds, forgiveness documentation, and the basis for the necessity certification at the time it was made.

Protect your people and the business

Employees should receive Upjohn warnings in internal interviews: company counsel represents the company, not them. Executives with personal exposure usually need separate counsel. Check indemnification and D&O insurance terms early, including consent and choice-of-counsel provisions. Contractors should assess suspension and debarment risk now, and healthcare providers should evaluate overpayment reporting obligations under the 60-day rule.

Part 2: The Criminal Road Map, From Investigation to Indictment

Not every civil FCA case has a criminal side, but many start with one quietly open. Signs that prosecutors are involved: a grand jury subpoena, a search warrant, FBI, DCIS, HHS-OIG, or SBA-OIG agents visiting employees at home, or a target letter.

Stage 1: Grand jury investigation

Prosecutors use the grand jury to subpoena records and testimony, often from employees, vendors, banks, and billing companies. The Justice Manual (§ 9-11.151) sorts people into three categories: a witness has information; a subject is someone whose conduct is within the scope of the investigation; a target is someone the prosecutor has substantial evidence linking to a crime and who is likely to be charged. Your status can change, and it is the first thing counsel should learn.

Stage 2: The target letter and pre-indictment advocacy

A target letter is an invitation to engage before charges are filed. Options include a written or in-person presentation to the prosecutors, a proffer (an interview under a limited-use agreement), or silence. Each carries risk. Proffers, in particular, can create evidence against you if handled poorly. For companies, DOJ’s Criminal Division Corporate Enforcement Policy (revised May 2025) describes a path to declination for companies that voluntarily self-disclose, fully cooperate, and remediate, which makes the timing of any disclosure decision critical.

Stage 3: Indictment and what follows

After indictment come arraignment, discovery, motions (including motions to dismiss and to suppress), and then plea negotiations or trial. If there is a conviction, sentencing under the U.S. Sentencing Guidelines is driven largely by the alleged loss amount (§ 2B1.1), with an added enhancement for federal healthcare offenses above $1 million. How loss is calculated is often the most consequential fight in the case.

Charges That Often Accompany a Criminal False Claims Case

Prosecutors rarely charge 18 U.S.C. § 287 alone. The companion charges often carry heavier sentences, and a conspiracy charge can reach people who never signed a claim.

Statute	What it covers	Maximum prison term	Most common in
18 U.S.C. § 287	Knowingly presenting a false claim to the United States	5 years	All three
18 U.S.C. § 286	Conspiracy to defraud the government with respect to claims	10 years	All three
18 U.S.C. § 371	Conspiracy to commit an offense or to defraud the United States	5 years	All three
18 U.S.C. § 1001	False statements to a federal agency or agent	5 years	All three
18 U.S.C. § 1343 / § 1341	Wire and mail fraud	20 years (30 if a financial institution is affected)	All three
18 U.S.C. § 1031	Major fraud against the United States (contracts of $1 million or more)	10 years	Procurement
41 U.S.C. § 8707	Kickbacks in federal contracting (Anti-Kickback Act)	10 years	Procurement
18 U.S.C. § 1347 / § 1349	Health care fraud and conspiracy	10 years (20 with serious bodily injury; life if death results)	Healthcare
42 U.S.C. § 1320a-7b(b)	Anti-Kickback Statute (federal health programs)	10 years	Healthcare
18 U.S.C. § 1035	False statements relating to health care matters	5 years	Healthcare
18 U.S.C. § 1014 / § 1344	False statements to a lender; bank fraud	30 years	PPP
18 U.S.C. § 1956 / § 1957	Money laundering and monetary transactions in criminal proceeds	20 / 10 years	PPP, healthcare
18 U.S.C. § 1028A	Aggravated identity theft	2 years, mandatory and consecutive	Healthcare, PPP
18 U.S.C. § 1519	Destruction or falsification of records	20 years	All three

 

Time limits for criminal charges. The general federal limit is five years (18 U.S.C. § 3282). It is seven years for major fraud (§ 1031), ten years for offenses affecting a financial institution (§ 3293), and ten years for PPP fraud under the 2022 PPP and Bank Fraud Enforcement Harmonization Act. Conspiracy periods typically run from the last act in furtherance.

If you or your company may be facing charges, see our federal criminal defense and OIG investigation pages.

What CEOs and Executives Face Personally

Company counsel represents the company. When the interests of the company and an individual diverge (and in fraud investigations they often do), you need your own lawyer. Executives can be named individually in a civil FCA suit, charged criminally, excluded from federal healthcare programs by HHS-OIG, or suspended and debarred from government contracting. A company’s path to cooperation credit can involve identifying the individuals responsible, which is why an executive’s first interview should never happen without preparation.

What Not to Do This Week

•    Do not talk to agents, auditors, or the relator’s lawyer without counsel, even “just to clear things up.” •    Do not delete, clean up, or “organize” emails, files, or billing records. •    Do not contact the suspected whistleblower or change their job duties. Retaliation is a separate claim under 31 U.S.C. § 3730(h). •    Do not produce documents beyond what was requested, or before scope is negotiated. •    Do not assume a forgiven PPP loan, a closed audit, or a paid overpayment ends the matter. •    Do not let the company’s lawyer also serve as your personal lawyer if your interests may differ.

 

Who Will Defend You: Former Prosecutors and Former Federal Officials

Many firms that rank for False Claims Act defense fall into two groups. Some are large national firms built for the largest corporate matters. Others handle a high volume of cases and represent whistleblowers as well as companies. Watson & Associates is built differently. Our FCA team pairs lawyers who ran fraud cases for the government with lawyers who administered the contracts and programs those cases are about. That combination matters because FCA cases are decided on two questions at once: what the law requires, and what the contract, billing rule, or loan certification actually meant in practice.

What sets this team apart is where its members sat. Carolyn L. Oliver served as an AUSA in the Major Frauds Section of the Southern District of California. Theodore P. Watson, a former federal agency executive and retired U.S. Air Force veteran admitted to the U.S. Supreme Court bar, has more than 23 years of federal practice and leads the team. Wise D. Allen, a former Navy Lieutenant Commander judge advocate, brings national and international contracting experience, and Robert Ayers has spent more than 20 years defending executives in complex federal financial matters. When the government builds its case on both tracks, you have people who have worked both sides of that house.

Ready to understand where you stand? Call 1 (866) 601-5518 or request a confidential case review. Have the document you received (CID, subpoena, target letter, or SBA/OIG letter) in front of you. You don’t need to organize anything else first. Download the False Claims Act Defense Checklist

Frequently Asked Questions About False Claims Act Defense

Is the False Claims Act civil or criminal?

The False Claims Act (31 U.S.C. § 3729) is civil and carries no prison term. The same conduct can be prosecuted as a crime under 18 U.S.C. § 287 and related statutes such as conspiracy, wire fraud, and health care fraud. DOJ policy requires its civil and criminal attorneys to coordinate, so both can proceed at the same time.

What is the penalty for violating the federal False Claims Act?

A civil violation carries treble (three times) the government’s damages plus a penalty of $14,308 to $28,619 for each false claim. Companies and individuals may also face exclusion from federal healthcare programs or suspension and debarment from government contracting. Criminal convictions carry prison terms that depend on the statute charged.

What is the statute of limitations for a False Claims Act case?

For civil cases, six years from the violation, or three years from when the responsible government official knew or should have known the facts, but never more than ten years (31 U.S.C. § 3731(b)). Criminal limits are generally five years, with longer periods for major fraud, bank-related offenses, and PPP fraud (ten years).

Can a CEO be held personally liable under the False Claims Act?

Yes. The statute applies to any “person” who knowingly presents or causes a false claim, and individuals can be sued civilly, charged criminally, excluded, or debarred. Personal liability usually turns on what the executive knew, what warnings reached them, and whether they acted on those warnings.

Can we still be charged criminally if the company settles the civil case?

Yes. A civil settlement typically releases civil claims only. Criminal exposure, especially for individuals, is resolved separately unless prosecutors agree otherwise, which is why civil and criminal strategy must be coordinated from the start.

Does PPP loan forgiveness end my exposure?

No. Forgiveness is not a finding that the loan was properly obtained. Congress set a ten-year limitations period for PPP fraud, and DOJ continues to bring both civil False Claims Act cases and criminal charges on forgiven loans.

How long does a False Claims Act investigation take?

It varies widely. The statutory seal lasts 60 days but is commonly extended, and many investigations run a year or longer before DOJ decides whether to intervene. Engaging counsel early is the most reliable way to influence both the timeline and the government’s view of the facts.

How do I find an attorney experienced in False Claims Act defense?

Look for lawyers who have handled FCA matters specifically, not just general litigation; who have government-side fraud experience; who understand the regulations behind your claims; and who can manage civil and criminal exposure together. Ask directly whether the firm also represents whistleblowers.

Sources

• S. Department of Justice, “False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025” (Jan. 16, 2026).
• S. Department of Justice, “National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud” (June 23, 2026).
• United States ex rel. Zafirov v. Florida Medical Associates, LLC, No. 24-13581 (11th Cir. Sept. 1, 2026).
• Federal Register, Civil Monetary Penalty Inflation Adjustment (May 21, 2026), noting cancellation of 2026 adjustments under OMB Memorandum M-26-11.
• PPP and Bank Fraud Enforcement Harmonization Act of 2022 (signed Aug. 5, 2022); DOJ and SBA announcements regarding “Operation No Doze” (Sept. 2026).
• Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016); United States ex rel. Schutte v. SuperValu Inc., 598 U.S. 739 (2023); Upjohn Co. v. United States, 449 U.S. 383 (1981).
• 31 U.S.C. §§ 3729–3733; Justice Manual §§ 1-12.000, 4-4.112, 9-11.151; DOJ Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy (rev. May 2025).

This article provides general information, not legal advice, and reading it does not create an attorney-client relationship. Every case depends on its facts. Prior results do not guarantee a similar outcome.