Title
Restoring Integrity to America's Financial System
Between May 19 and June 8, 2026, a single executive order and its first two deliverables moved together to treat a customer's immigration status — and especially the use of an ITIN — as a risk signal that banks and lenders may, and in some cases must, weigh. The order is the source instrument; the FinCEN advisory and the CFPB statement are the first transmissions down the wire.
MAPHow the package wires together
Executive Order 14406 sits at the top of the bus. Each operative directive runs to a separate agency action on its own statutory clock. Two have landed; three are still pending.
EO 14406 — Restoring Integrity to America's Financial System
Signed
Frames lending to non-work-authorized borrowers as a structural "ability-to-repay" deficiency and illicit cross-border flows as a national-security risk. Directs Treasury, FinCEN, the CFPB, and the federal banking agencies to act.
FinCEN Joint Advisory
Delivered Jun 5
Issued with the FDIC, OCC, and NCUA. Eighteen red flags and two core typologies — identity theft and off-the-books payroll fraud — across five labor-intensive sectors, plus ITIN due-diligence guidance and the SAR key term.
CFPB Statement on Ability to Repay
Delivered Jun 5–8
Tells creditors that under TILA / Regulation Z they may — and sometimes must — consider whether removal risk will disrupt a borrower's U.S.-based income.
BSA Customer Due Diligence rulemaking
Pending · ~Aug 17
Treasury to propose stronger risk-based CDD, including authority to seek immigration-status and work-authorization information where other risk indicators warrant.
Customer Identification Program review
Pending · ~Nov 15
Treasury and the banking agencies to weigh CIP changes addressing the risks foreign consular identification cards pose at account opening.
Prudential credit-risk guidance
Pending · ~Jul 18
Each federal banking regulator to issue guidance on managing the credit risk posed by the non-work-authorized population.
LINKThe connective tissue
A
One source, two clocks fired first
The advisory (§3(a)) and the CFPB statement (§4(a)) share the same 60-day deadline. Both landed inside two weeks of each other — a coordinated rollout, not three separate events.
B
The ITIN is the shared hinge
An ITIN presented in lieu of an SSN or work authorization is a CDD risk factor in the FinCEN advisory and, separately, a possible signal of removal risk in the CFPB statement. The same data point now reads across both AML and credit.
C
A predicate was already laid
In January 2026 the CFPB and DOJ withdrew their 2023 joint statement on noncitizen borrowers (91 FR 1138). The package builds on that reversal and on EO 14159's removal policy.
State angle
EO 14406 defines "Federal functional financial regulator" as the Fed, OCC, FDIC, and NCUA — state regulators are not named. But state-chartered banks and credit unions remain fully subject to the Bank Secrecy Act and to FinCEN advisories, and reach the federal credit-risk guidance through their federal prudential overseers. The supervisory expectations flow downhill regardless of charter.
01Executive Order 14406
The order rests on two distinct risk theories. The first is a national-security and public-safety argument: it points to low-dollar cross-border transfers used in terrorist financing, narcotics and human trafficking, fentanyl flows tied to Mexico-based cartels, and a cited analysis of Chinese money-laundering networks said to have moved more than $312 billion through U.S.-based accounts held by foreign passport holders.
The second is a safety-and-soundness argument aimed at consumer credit. The order asserts that lending to borrowers who lack work authorization or face a substantial loss-of-wage risk creates a structural ability-to-repay deficiency, because removal or an employer's compliance with immigration law could cut off the borrower's income. It also flags employer schemes — underreported wages, mismatched tax IDs, unremitted payroll taxes — as a vulnerability that distorts credit underwriting.
The five operative directives
Most are framed as actions agencies must consider or propose — the order itself imposes no new customer-facing requirement, and it stopped short of mandating citizenship verification for every account.
60Days · §3(a)
Treasury AdvisoryDue ~Jul 18 · Done Jun 5
Issue a red-flags advisory
Describe typologies of suspicious activity tied to non-work-authorized populations and their employers — payroll-tax evasion, nominee/funnel structures, off-the-books wage rails, structuring, labor trafficking, and ITIN-based account or credit access.
60Days · §4(a)
CFPBDue ~Jul 18 · Done Jun 5–8
Clarify the ability-to-repay standard
Consider clarifying that potential deportation and loss of wages are factors that can bear on a non-work-authorized borrower's ability to repay under the Regulation Z standards in 12 CFR Part 1026, and that lenders may weigh them in good-faith underwriting.
60Days · §4(b)
Banking AgenciesDue ~Jul 18 · Pending
Issue credit-risk guidance
Each federal functional financial regulator (Fed, OCC, FDIC, NCUA) to issue guidance on managing the potential credit risks posed by the non-work-authorized population.
90Days · §3(b)
TreasuryDue ~Aug 17 · Pending
Propose stronger CDD rules
Propose Bank Secrecy Act changes to strengthen risk-based customer due diligence, including verifying beneficial owners and preserving authority to obtain immigration-status and work-authorization information where other risk indicators warrant.
180Days · §3(c)
Treasury + AgenciesDue ~Nov 15 · Pending
Consider CIP changes
Weigh customer-identification-program changes that account for the risks foreign consular identification cards (e.g., the matrícula consular) pose to the integrity of the financial system.
Reading it precisely
The verbs matter. "Consider," "propose," and "issue guidance" set a rulemaking and supervisory agenda rather than a self-executing mandate. Commentators note the immigration-status inquiry in §3(b) is framed as confirming existing risk-based authority — permissive, not a categorical new obligation.
02FinCEN Joint Advisory
The advisory executes §3(a) of EO 14406. FinCEN issued it jointly with the FDIC, OCC, and NCUA — the Federal Reserve is not among the joint issuers — and in coordination with the IRS. It tells institutions, banks in particular, to watch for fraud tied to the unlawful employment of workers without authorization, framing that activity as depressing wages, enabling identity theft of work-authorized people (including U.S. citizens), and diverting payroll-tax revenue. It maps to FinCEN's AML/CFT National Priorities — fraud, terrorist financing, drug- and transnational-criminal-organization activity, and human trafficking and smuggling — and builds on FinCEN's 2023 construction-sector payroll-tax notice and a November 2025 cross-border-transfer alert.
How much weight it carries
The advisory is guidance, and it says so plainly: its red-flag indicators do not, on their own, convey or alter any independent regulatory obligation or supervisory expectation. In practice, counsel still expect it to shape transaction-monitoring scenarios and SAR narratives — but the document is careful not to claim it creates new duties.
How the scheme works
Two typologies anchor the advisory. Both turn on concealing who is really being employed and paid.
Typology 1 · Identity theft
Borrowed identities to pass I-9
Workers without authorization obtain SSNs and other personal data of citizens and lawful residents to make Form I-9s look legitimate, draw wages and benefits, and — per FinCEN's review of BSA reporting — obtain auto and other credit. Complicit employers may help procure the fraudulent documents.
Typology 2 · Payroll fraud
Off-the-books pay via labor brokers
Employers route wages through complicit labor brokers who stand up shell companies — often unregistered money services businesses — to cash employer checks and pay workers off the books, withholding no payroll tax and "renting" minimal workers'-comp policies to commit insurance fraud.
Source
Complicit employer
Writes checks to a shell company for purported industry services.
Intermediary
Labor broker
Takes a 4–10% fee; opens shell accounts with a foreign passport or ITIN; uses a mail-drop to dodge CIP.
Conduit
Shell co / unregistered MSB
Cashes checks in structured transactions through banks and check cashers.
Payout
Worker, off the books
Paid by cash courier, check, or P2P — structured below BSA thresholds on payroll cycles.
FinCEN reports institutions flagged more than $2.5 billion in suspicious activity tied to this scheme in 2025; the 2022 employment-tax gap was roughly $127 billion.
Case study · Identity theft
A Mexican national pleaded guilty in July 2025 after working at a North Carolina manufacturer since 2022 using another person's driver's license and Social Security card, and falsely attesting U.S. citizenship on his I-9.
Case study · Payroll fraud
Two Honduran nationals were sentenced in April 2026 over a years-long scheme that cashed roughly $89 million in construction checks through shell companies, evaded payroll taxes, and caused a federal loss exceeding $38 million.
Enhanced due diligence for ITINs
Under existing CIP rules a bank must collect and verify customer identity, including an identification number — a TIN for U.S. persons, or for non-U.S. persons a TIN, passport, alien ID card, or other government photo ID. An ITIN (nine digits, beginning with 9, in the form 9XX-7X-XXXX) is issued for federal tax purposes only and does not prove legal status, grant work authorization, or serve as identification outside the tax system.
Per EO 14406, the Agencies say an ITIN presented in lieu of an SSN or valid work-authorization document may be a risk factor warranting enhanced due diligence — judged against the totality of available information — and they flag particular concern when an ITIN is used to obtain credit or open an account where legal presence isn't verified. Separately, where a bank doubts an SSN's authenticity, FinCEN encourages checking it against Social Security Administration records.
On the ITIN
The ITIN is positioned as a trigger for closer, risk-based review judged in context — not an automatic bar to an account or product. The advisory ties this directly to the executive order rather than to any new rule.
Red-flag indicators
All eighteen indicators target five labor-intensive sectors — agriculture, construction, domestic service, hospitality, and staffing — and are grouped by customer type. Tap a group to expand. No single flag is determinative; FinCEN says to weigh the totality of facts and look for several flags together.
- Presents an SSN that, on verification, doesn't match SSA records.
- Opens an account with a non-U.S. passport or ITIN as "self-employed" in the five sectors, takes in large recurring check deposits from many companies, then makes structured cash withdrawals or writes low-dollar checks to many people.
- Cashes a large, recurring volume of checks drawn on companies in those sectors at an MSB or check casher.
- Receives recurring P2P payments from a small, newly formed company in those sectors.
- Works in those sectors and opens an ITIN account with little activity beyond foreign remittances.
- Tries to open a company account in those sectors using a commercial mail-receiving agency instead of a business address.
- Has no prior tie to those sectors but uses a non-U.S. passport or ITIN to open a new company account in them.
- Tells tellers or check cashers the cash or check-cashing is "payroll," in volumes out of step with a small-staff business.
- Appears in ICE worksite-enforcement releases or open-source reporting for a history of compliance violations.
- Has substantial operations and transaction volume but little payroll activity for its profile.
- Makes federal and state payroll-tax deposits far below what its operations and workforce would imply.
- Issues large, repetitive checks to one or a few newly formed companies with little online presence.
- Recently bought a workers'-comp policy covering few workers, inconsistent with its profile and activity.
- Beneficial owners with no prior tie to the company or industry, sometimes with prior fraud convictions.
- Little or no tax- or payroll-related payments to the IRS, state authorities, or a payroll provider despite heavy client deposits.
- Large or unusual cash withdrawals or check-cashing — often accompanied by others or using an armored-car service for bulk cash (informal, off-the-books payroll).
- Issues recurring, high volumes of sub-$1,000 checks payable to many separate individuals who cash them.
- New (under two years old), with minimal online presence and other shell-company indicators.
FinCEN's own caveats
No single indicator is determinative, and none should be read in isolation. Institutions should weigh surrounding facts — a customer's history, whether activity fits prevailing business practice, and whether several flags appear together. FinCEN stresses no customer type carries a uniform risk profile, and that the indicators themselves do not alter any regulatory obligation or supervisory expectation.
Reporting & tips
Reference the advisory by placing FINANCIALINTEGRITY-2026-A002 in SAR field 2 and the narrative. FinCEN also points institutions and the public to ICE's tip line, (866) 347-2423, for employers suspected of knowingly employing or exploiting unauthorized workers, and notes its whistleblower program offers awards where an enforcement action yields penalties over $1 million, with anonymous submission available through counsel.
03CFPB Statement
The statement executes §4(a) of the order. Its core move: under the Truth in Lending Act and Regulation Z, creditors must make a reasonable, good-faith ability-to-repay determination before extending mortgages and certain open-end credit. That determination rests on current or reasonably expected income — and the Bureau reminds lenders that where the application or records indicate a reasonably anticipated change in repayment ability, the creditor must consider it.
Applied to immigration: if a creditor relies on income from U.S.-based employment, and information in the file (including reliance on atypical identification such as an ITIN) suggests the borrower may be unlawfully present and at risk of removal, the Bureau says that bears on whether the income will remain available. Overlooking it, in the Bureau's view, may fall short of the ATR obligation.
Mortgages
12 CFR 1026.43(c)
Creditors must reasonably and in good faith determine ability to repay, considering current or reasonably expected income and employment status. A post-consummation change that couldn't be reasonably anticipated from the file isn't relevant.
Credit cards
12 CFR 1026.51(a)
Issuers must consider the consumer's ability to make required minimum payments, using income or assets to which the consumer has a reasonable expectation of access at account opening or a credit-limit increase.
The Regulation B / ECOA backdrop
The statement leans on existing fair-lending text: Regulation B, implementing ECOA, already says a creditor may take an applicant's immigration status into account, and may consider status and related information needed to ascertain its rights and remedies on repayment. The Bureau ties this to its January 2026 withdrawal of the 2023 CFPB–DOJ joint statement on noncitizen borrowers, which had cautioned against using immigration status in credit decisions.
What it does not do
The Bureau states the guidance has no force or effect of law. It declines to map each lawful immigration status to a repayment expectation, stressing that statuses vary widely and can't be assumed identical. Changes that can't be reasonably anticipated from the file need not be considered — the obligation is triggered by what the record actually shows.
The fair-lending tension
Industry analysts flag the hard part: incorporating removal risk into underwriting while staying clear of ECOA's prohibition on discrimination by national origin or race. Some firms note the statement reminds lenders of an obligation without supplying status-by-status detail to operationalize it — leaving institutions to document a defensible, individualized rationale rather than apply blanket rules.
04Coverage & Analysis
Everything cited in this tool, with links. Filter by type, or read top to bottom: primary government sources first, then law-firm analysis, news media, and trackers.
Primary sources — government
Restoring Integrity to America's Financial SystemEO · White House
Full text of EO 14406 as posted by the White House. →
EO 14406 in the Federal Register91 FR 30479
Official published version of the executive order. →
Fact Sheet on the executive orderFact sheet
Administration's summary of the order's goals and directives. →
FinCEN Joint Advisory (full PDF)FIN-2026-A002
The advisory itself — red flags, typologies, and SAR filing instructions. →
Treasury press release on the advisoryTreasury
Announcement with Secretary Bessent's framing and the ITIN guidance summary. →
NCUA press release on the joint advisoryNCUA
Prudential-regulator framing; confirms the advisory supports EO 14406. →
CFPB Statement on Ability to Repay & Immigration Status91 FR 34607
Full text and footnotes of the CFPB statement. →
CFPB statement — official PDFgovinfo
The authoritative print edition of the CFPB statement. →
Withdrawal of the 2023 noncitizen-borrower joint statementPredicate · 91 FR 1138
The January reversal that set the stage for the June statement. →
Law firm & industry analysis
Executive Order Signals Major Shift in Federal ExpectationsBallard Spahr
Deadline-by-deadline breakdown across BSA/AML, CIP, CDD, and underwriting, with practical implications. →
CFPB Guidance Without Sufficient Detail to Assist CreditorsBallard Spahr
Critique of the CFPB statement for reminding lenders of an obligation without operational status-by-status detail. →
What the EO and FinCEN's Proposed Rules Mean for Banks and MSBsPerkins Coie
Reads §3(b) immigration-status authority as permissive; covers CIP, consular IDs, and MSB scope. →
EO Directing Regulators to Address Risks from Customer Immigration StatusMayer Brown
Early read on the structural ability-to-repay theory and the directives' reach. →
White House Issues Orders Targeting Financial System IntegrityCooley
Notes the order stops short of mandatory citizenship verification and creates rolling deadlines. →
News media
Trump Moves to Tighten Banking Access for Non-CitizensTIME
News framing on the order and its potential effect on access to financial services. →
CFPB Advises Lenders to Consider Applicants' Immigration StatusPYMNTS
Coverage of the CFPB statement and its link to the January joint-statement withdrawal. →
CFPB Guidance Points Mortgage Lenders to Consider Immigration StatusHousingWire
Mortgage-industry angle on when status may need to factor into ATR. →
Trackers & explainers
EO 14406 policy entryImmigration Policy Tracking
Tracked entry linking the order to the FinCEN advisory and downstream actions. →
EO 14406 — context and affected agenciesExecutive Actions
Plain-language summary, historical context, and the list of implementing agencies. →
A note on framing
Coverage splits predictably. Industry counsel reads the package as a compliance-planning problem on a tight clock; news and immigration-advocacy outlets emphasize the risk of narrowing financial access for noncitizens, including some lawfully present. Both can be true at once — the documents set supervisory expectations whose real-world reach depends on the pending rules and guidance.