Donald Trump’s personal lawyer Micheal Cohen is under investigation for “criminal conduct that largely centers on his business dealings,” according to a filing by federal prosecutors.

Among other things, investigators are “examining whether Mr. Cohen fraudulently used a bank loan for something other than the purpose he described on his loan application,” the Wall Street Journal reported, citing a person familiar with the probe. First Republic, the bank where Cohen took out the loan, also reported a $130,000 payment by Cohen as potentially suspicious to the US Treasury department, the Journal reported.

Cohen said in March that he used funds from a home equity line of credit to give $130,000 to porn star Stormy Daniels on behalf of Trump, with whom she says she had a sexual relationship before he became president. ”The funds were taken from my home equity line and transferred internally to my LLC account in the same bank,” Cohen told CNN.

Banks are required by “Know Your Customer” rules to do due diligence on customers, and transactions over $10,000 can trigger automatic reporting to financial authorities, thanks to rules designed to prevent money laundering and other criminal activity. Cohen may also have had to explain to his bank why he was making the payment.

First Republic advertises a home equity line with no annual review so customers can “tap into the equity in your home to fund the projects that are important to you—whenever you need it.” Suggested uses include “renovations on your current home,” “buying a vacation home or funding a child’s college tuition.”

While paying off your client’s putative mistress isn’t advertised, there’s no financial rule against it, financial advisors tell Quartz. However, the US bank-fraud statute makes it illegal to “obtain any of the moneys, funds, credits, assets, securities, or other property owned by, or under the custody or control of, a financial institution, by means of false or fraudulent pretenses, representations, or promises,” and carries a maximum penalty of 30 years in prison or a million-dollar fine.

The possibility of any bank-fraud charge could hinge on what Cohen told the bank he was doing with the loan, explains Andrew Comstock, a chartered financial analyst with Castlebar Asset Management, a Kansas investment advisor.

“If he established a new line of credit and claimed it was for a home remodel when his only intention was to pay someone off, it could be looked at as bank fraud,” he said—but that’s only likely if Cohen “explicitly lied.”

If fact, some banks don’t even ask borrowers what they intend to do with the proceeds, Comstock noted, while others will accept a broad designation, such as personal expenses.

Generally, no lender is going to police what you did with the money unless you didn’t pay it back, said Greg McBride, chief financial analyst with Bankrate.com, which compares banking services. “The main thing they’re trying to protect against is outright fraud.”

However, you may not be able to get a home equity loan in the first place if you do tell your lender you’ll be doing something highly unusual with it, analysts noted. Banks might consider such a loan risky.

In fact, Cohen complained to friends after the 2016 election that Trump had not paid him back.

Home equity lending was a huge contributor to the subprime bubble that led to the global recession of 2008, but the volume of loans has tapered off since:

For Cohen, there may still have been one loan too many.