Any limitations on reporting a loan fraud will purely be a function of state, not federal, law.
In very general terms, the consumer is not required to take any specific action. As long as he tells you about it, you are on notice. From my perspective, the only time the clock beguns to run on the victim is when your bank takes some legal action intended to enforce the debt and he has to assert some defense.
There are time frames in which deposit related fraud must be reported because, in reviewing his statements, the consumer has an opportunity to know. The same rationale does not apply to a loan, there is no basis for assuming that the consumer knew or should have known.
_________________________
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.