Federal regulators recently took two coordinated steps that significantly shift expectations for how lenders and banks treat non‑work authorized individuals and their employers. On June 5, the Consumer Financial Protection Bureau (CFPB or Bureau) issued a formal statement on how immigration status should factor into ability‑to‑repay determinations under the Truth in Lending Act (TILA) and Regulation Z. On the same day, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), jointly with the federal banking agencies and in coordination with the Internal Revenue Service (IRS), released a detailed advisory on fraud, payroll schemes, and money laundering risks associated with the unlawful employment of non-work authorized persons, including specific guidance regarding the use of Individual Taxpayer Identification Numbers (ITINs) and Suspicious Activity Reports (SARs).

Taken together, these actions signal a clear policy direction: immigration status and work authorization are no longer peripheral issues for underwriting and Bank Secrecy Act (BSA)/anti-money laundering (AML) compliance programs. They are now squarely in the compliance mainstream and, according to federal regulators, factors that financial institutions must consider.

CFPB: Immigration Status and Implications for Ability‑to‑Repay

The CFPB’s new Statement on Ability to Repay and Immigration Status, issued under TILA and Regulation Z with references to the Equal Credit Opportunity Act (ECOA) and Regulation B and tied explicitly to Executive Order 14406, “Restoring Integrity to America’s Financial System,” (discussed here) does not change the underlying statutory or regulatory text, but rather clarifies how the Bureau expects creditors to apply existing rules.

The statement reiterates that mortgage lenders must make a reasonable, good faith determination of a consumer’s ability to repay based on current or reasonably expected income or assets, and that credit card issuers must consider a consumer’s ability to make required minimum payments, as required by TILA and Regulation Z. Those assessments are judged based on what was known, or reasonably knowable, from the application and underwriting records at the time that credit was extended. Unforeseeable later events do not retroactively create a violation.

What is new is the Bureau’s emphasis on how immigration status can affect the forward‑looking assessments referenced above. As noted in the Bureau’s statement, Regulation B already permits lenders to consider immigration status to protect their rights and remedies regarding repayment. The CFPB now stresses that when repayment depends on U.S.‑based employment and the application file contains information indicating that the consumer may not be lawfully present in the U.S., may lack work authorization, or may otherwise be at risk of removal, a creditor may be obligated to factor those indications into its ability‑to‑repay analysis. The statement highlights, for example, circumstances where documentation suggests an unlawful presence or reliance on ITINs in ways that signal a heightened risk that U.S. employment income will not continue.

At the same time, the CFPB acknowledges the wide variety of lawful immigration statuses and declines to prescribe bright‑line rules across categories. Instead, the CFPB expects creditors to make reasoned, documented judgments about when a particular status or set of facts suggests a reasonably expected change in future income. Crucially, the statement does not authorize blanket denials based on noncitizen status or ITIN use. The ECOA and fair lending concerns still constrain how immigration‑related information may be used.

In practical terms, financial institutions should consider updating their underwriting policies to adequately address when and how immigration status, lawful presence, work authorization, and related indicators of removal risk will be considered in ability‑to‑repay determinations, particularly where income is tied to a borrower’s physical presence in the U.S. Those policies will need to be carefully drafted to remain focused on repayment risk while avoiding discriminatory or overbroad categorical exclusions.

FinCEN: Non‑Work Authorized Populations and Integrity of the U.S. Financial System

FinCEN’s Joint Advisory FIN‑2026‑A002, issued with the banking agencies and in coordination with the IRS, pulls themes similar to those in the CFPB’s statement into the BSA/AML space. Framed as part of a “whole‑of‑government” effort under Executive Order 14406, “Restoring Integrity to America’s Financial System,” and Executive Order 14159, “Protecting the American People Against Invasion,” the advisory describes how unlawful employment of non-work authorized persons, identity theft, payroll fraud, and shell‑company labor brokers can be used to evade payroll taxes, depress wages, defraud insurers, and move funds through the U.S. financial system in support of transnational criminal organizations and even designated terrorist organizations.

FinCEN details how complicit employers and labor brokers use fraudulent or stolen Social Security numbers and other identifiers to obtain employment and benefits, open accounts, and secure credit for individuals who are not authorized to work. It also describes off‑the‑books cash payroll schemes in which shell companies receive large volumes of checks from contractors, cash or deposit those checks, and then pay unlawful workers in cash or with low‑dollar checks in an effort to evade reporting thresholds, all while avoiding payroll taxes and underreporting to insurers.

A significant element of the Advisory is its treatment of ITINs. FinCEN underscores that ITINs are issued solely for federal tax purposes and do not evidence legal status or authorize work. Consistent with Executive Order 14406, the advisory “encourages” banks subject to the federal banking agencies’ jurisdictions to treat the use of an ITIN, in lieu of a Social Security number or valid employment authorization document, to obtain credit products or open depository accounts as a risk factor that may warrant enhanced due diligence. Institutions are expected to consider ITIN use in the context of the customer’s overall risk profile, particularly for customers in industries such as agriculture, construction, domestic service, hospitality, and staffing, where unlawful employment schemes have been prevalent.

In the advisory, FinCEN also provides extensive “red flag” patterns that are tied to unlawful employment and payroll fraud, and requests that institutions filing SARs on such activity include the key term “FINANCIALINTEGRITY‑2026‑A002” in SAR field 2 and in the narrative to aid aggregation and analysis.

For financial institutions, the message is that consumers who are non‑work authorized individuals, and employers and labor brokers who rely on such individuals, are now firmly embedded in AML/countering the financing of terrorism (CFT) supervisory priorities. Customer due diligence programs, onboarding processes, and transaction monitoring for relevant sectors and ITIN use will need to be reviewed and, in many cases, tightened to reflect the advisory’s typologies and expectations.

Our Take

The CFPB and FinCEN actions move immigration status and work authorization from the margins of compliance into the mainstream for purposes of both consumer credit underwriting and BSA/AML. Lenders should consider updating their ability‑to‑repay and related policies and procedures to account for a consumer’s reasonably foreseeable changes in income that are related to immigration and work status, while carefully managing risk stemming from fair lending and unfair, deceptive, or abusive acts or practices laws. In addition, financial institutions should revisit their risk assessments, customer due diligence procedures, and monitoring processes for ITIN use and higher‑risk industries in light of the new FinCEN guidance.