According to newly-released guidance from the SBA and Treasury on Wednesday, businesses that accepted PPP loans they didn’t need (based on the certification requirement) will be able to repay the money without facing further action, and loans under $2 million likely won’t be targeted for review. Previously, Treasury Secretary Steven Mnuchin stated that firms would be held “criminally liable” if they failed to meet the PPP’s terms.

Many businesses (large and small) have been wrestling with returning or keeping their loans for weeks. As late as Tuesday night, Pamela Zell, who runs a financial planning firm in Missouri, was still debating whether to keep or return her $68,000 PPP loan.

Guidance from the SBA in recent weeks about having to demonstrate the necessity of the loan she received concerned Zell—After all, she never had to lay off any employees beforehand, despite revenues slowly ticking down each month. Zell says the changing guidelines have been a frustrating ordeal: “I feel like they’re throwing this stuff at us so quickly, and oh, by the way, we’re all still trying to run businesses as well.” But she decided following the new guidance on Wednesday, she’s keeping her loan.

Plenty of other businesses have been in the same boat in recent days.

So far, Minnesota-based regional bank Sunrise Banks has had four loans returned, CEO David Reiling tells Fortune, only one of which was for over $2 million. Meanwhile, others like Heather Bain, a CPA and chair of the Small Business Committee for the Institute of Management Accountants, tells Fortune several of her clients had already returned the loans because many thought “the risk is too high,” she says. They had been “looking at the cost to defend the position,” and for some, it wasn’t worth it, she says.

Concerns over certifying necessity

When the now-$669 billion PPP was first launched, a central requirement for businesses applying for loans was that they certify that economic uncertainty “makes this loan request necessary to support the ongoing operations of the Applicant” amid the coronavirus pandemic.

However, guidelines surrounding exactly who is eligible and how to certify necessity have caused confusion. After the first round of funding ran dry, the public was surprised that many large chains and public companies, including Shake Shack and the Los Angeles Lakers, got PPP loans. (Both have since returned their loans). Such loans drew the ire of Mnuchin, who recently told the Wall Street Journal, “Some of these companies should be apologizing. The owners should be apologizing that they took this, not just giving the money back.”

Following the public company backlash, guidelines came in the form of an FAQ on April 23, in which the SBA noted that certifying necessity must take “into account [the borrowers’] current business activity and their ability to access other sources of liquidity sufficient to support their ongoing operations in a manner that is not significantly detrimental to the business,” stating it would be “unlikely” for public companies to be able to make these required certifications. Mnuchin also announced any loan over $2 million would be audited.

When does the PPP safe harbor expire?

As a result, the administration is now giving businesses a safe harbor, or amnesty period, until May 18 (extended from May 14 and from May 7 before), to return the funds in full—in which case they will be “deemed by the SBA to have made the required certification in good faith.” However, the “safe harbor” guidance issued by the SBA on Wednesday states that companies (including their affiliates) who accepted loans under $2 million will automatically be determined to have made the required certification of necessity in good faith because they’re less likely to have access to such sources of liquidity.

In other words, “if a borrower received a PPP loan under $2 million and was otherwise eligible, but uncomfortable with the needs-based certification, [they] should now be comfortable keeping the loan and applying proceeds as directed under the PPP,” says Ken Logsdon, a partner at law firm Dorsey & Whitney.

The SBA will still review all loans over $2 million (and possibly others as well) to ensure businesses met the certification requirements for needing the loan, and if they are found ineligible, the borrower’s loan won’t be forgiven and they will be required to return the loan without any further action, per the new guidance.

Do public companies have to return PPP loans?

Despite a spate of negative press, many public companies still have not returned loans as of Wednesday afternoon. So far, of the over 400 public companies who received PPP loans, some $400 million has been returned from 60 loans as of Wednesday, according to Washington, D.C.–based data analytics firm FactSquared. Meanwhile, other public companies disclosed as recently as Tuesday that they accepted PPP loans, according to financial filings, and did not indicate they would return them. One such public company, AstroNova Inc, which specializes in data visualization technology and specialty printers, announced in a filing Tuesday the company had accepted a roughly $4 million PPP loan, days before the previous May 14 deadline for return. The company did not immediately respond to Fortune‘s request for comment on whether the company intended to return the loan before the deadline.

The SBA guidelines don’t explicitly prohibit public companies from keeping loans, but the guidance has stated that due to access to capital markets and “other sources of liquidity,” it is “unlikely” they’d be able to clear that good-faith certification bar—notably for loans over $2 million.

What does ‘other sources of liquidity’ mean?

Many attorneys and small businesses have also been confused by vague guidelines for the program from the onset.

One provision in the original SBA guidelines waived the “credit elsewhere” test proving small businesses couldn’t receive the loans anywhere else. But amid recent new guidance regarding certifications, attorneys and small businesses have been scratching their heads about the phrase “other sources of liquidity.” Some companies had even filed lawsuits against the Treasury and SBA claiming the new guidance was unlawful based on that original standard.

In recent weeks, Lodgson has seen a lot of companies “second-guessing” their analysis after the new guidance (FAQ 31) was published. Many have wondered if personal finances would be brought into question as “other sources of liquidity.” New guidance still doesn’t shed more light on exactly what will be considered adequate other sources of liquidity.

Now, the new SBA guidance suggests loans under $2 million likely won’t be immediately subject to this scrutiny (the SBA said the safe harbor was “appropriate because borrowers with loans below this threshold are generally less likely to have had access to adequate sources of liquidity in the current economic environment than borrowers that obtained larger loans”). However, companies with loans over $2 million still face these reviews.

What should businesses know about their loans now?

The problem was, “you have uncertainty with regard to not only the definition, but what the enforcement mechanisms are going to look like later,” says Derek Cohen, a partner at law firm Goodwin’s white collar defense group. The fear many businesses had was running afoul of the False Claims Act, which could subject them to penalties as much as three times the amount of the loan “if it was determined that they knowingly or recklessly filed a false certification in regards to their application,” adds Cohen. From a legal standpoint, Cohen notes that demonstrating somebody “acted in bad faith” would have been difficult to prosecute amid a lack of clarity and some subjectivity involved in the analysis. Now, the new guidance suggests that for loans under $2 million and based solely on the needs certification, facing a False Claims Act charge “seems very unlikely,” Logsdon says. Even if loans over $2 million are found to be ineligible, the guidance suggests businesses will have to repay the loans, but won’t face legal consequences.

However, Logsdon points out the safe harbor in the newly-issued guidance only applies to the needs-based certification—it won’t “act as a cure for other deficiencies.” In other words, anything nefarious is likely fair game.

Cohen notes any criminal cases will likely be addressing “just brazen fraud.” In fact, one such case has already surfaced. The Justice Department is charging two businessmen in Rhode Island who received PPP loans with fraud, alleging they falsely claimed employees they don’t have on their application.

To wit, it appears firms with loans over $2 million will still be held to the guidance in FAQ 31, which includes examining “other sources of liquidity.” In that sense, attorneys and CPAs point out that having an undrawn revolving credit facility might prove a viable option for liquidity that the SBA could look at and determine the loan wasn’t necessary, while others like lines of credit that couldn’t be drawn on further at risk of breaking covenants and falling out of compliance could be compelling evidence the loan was needed.

Anne Railton, a partner at Goodwin focusing on white collar criminal defense and government civil investigations, notes the “prudent course for all borrowers” has been to reassess the necessity of the loan in light of the latest SBA guidance.

Some believe the new guidelines are a positive development that are going to “ease a lot of that anxiety” over keeping loans, Paul Merski of the Independent Community Bankers of America, told Bloomberg Wednesday.

Yet with guidance coming late on the eve of the previous deadline, those like Logsdon were unsure whether the safe harbor period would actually scoop up the right businesses: “I suspect there [have been] many companies out there that probably were intended to receive the PPP loan and [were] … too discouraged due to recent events and [decided] to send it back unfortunately.”

More must-read finance coverage from Fortune:

—Saving lives vs. saving the economy is a false tradeoff, economists say
—Real unemployment rate soars past 24.9%—and the U.S. has now lost 33.5 million jobs
—17% of unemployed workers aren’t looking for work—and that’s warping the official unemployment rate
—Does Apple’s stock buyback strategy make sense in this market?
—Goldman Sachs doubts there will be a Round 3 of PPP loans for small businesses
—Listen to Leadership Next, a Fortune podcast examining the evolving role of CEO
—WATCH: Why the banks were ready for the financial impact of coronavirus

Subscribe to How To Reopen, Fortune’s weekly newsletter on what it takes to reboot business in the midst of a pandemic