Update: JPMorgan later said that the fraud found was related to the EIDL program.

The embattled Paycheck Protection Program, rolled out in April to help keep small businesses alive during shutdowns, has long been flagged for possible fraud. Now, the program’s biggest lender is investigating some of its own employees for aiding misuse of funds by customers.

In a memo sent from senior staff Tuesday, first reported by Bloomberg and also viewed by Fortune, the bank found “instances of customers misusing Paycheck Protection Program Loans, unemployment benefits and other government programs,” adding that some of JPMorgan’s own “employees have fallen short, too,” per the memo.

JPMorgan was the PPP’s biggest lender, dolling out some $29.4 billion in funds across over 280,000 loans before the program ended on Aug. 8. The firm said in the memo Tuesday it had found “conduct that does not live up to our business and ethical principles” that “may even be illegal.”

Trish Wexler, a spokesperson for JPMorgan, declined to comment further to Fortune.

The risk of illegal actions and misuse of the government funds has been top of mind for government watchdogs, government officials, and the media since the program’s rollout in early April. The Federal Bureau of Investigation and Department of Justice have already levied cases against possible fraudsters, and as of a June 9 report, nearly 100 cases had been initiated since the program’s rollout, some already leading to convictions. Shortly after the program began, there was also general outcry over large, publicly-traded companies receiving loans while smaller businesses struggled to access the funds.

Meanwhile, House Democrats released a preliminary report last week that found over $1 billion in funds went to companies with multiple loans, writing the program had a “high risk for fraud, waste, and abuse.” Additionally, the analysis found that roughly $3 billion was “flagged” by the federal government’s System for Award Management (SAM) database and PPP loan-level data, the Select Subcommittee on the Coronavirus Crisis wrote in the report—building on earlier claims that “there is a significant risk that some fraudulent or inflated applications were approved,” per a June report by the Government Accountability Office (GAO).

All told, loans from the government program went to over 5 million small businesses, but left over $130 billion in unused funds, per the latest Small Business Administration report.

Now, JPMorgan said Tuesday “we are doing all we can to identify those instances, and cooperate with law enforcement where appropriate,” per the firm’s memo, telling employees “We need everyone to be vigilant.”

After all, Maria Earley, a financial services regulatory and enforcement partner at international law firm Reed Smith, told Fortune back in April that “There will be fake companies, and there will be people doing fraudulent things, and no bank wants to be the one that approved that [application].”