Key dates
- 2026-06-08
- CFPB issued the Statement on Ability To Repay and Immigration Status referenced by the agencies
- 2026-07-13
- FDIC, OCC, and NCUA issued the interagency guidance on lending to individuals not legally authorized to work in the United States
Suggested considerations
- Compliance teams may wish to review underwriting standards to confirm that capacity-to-repay analysis captures employment-authorization-related income instability.
- Firms should consider whether credit policy, risk grading, and portfolio monitoring procedures explicitly address elevated repayment uncertainty for non-work-authorized borrowers.
- Institutions may wish to reassess documentation and verification controls for income, employment, and supporting records in light of the agencies' stated focus on safe-and-sound lending.
- Teams should consider whether fair-lending, TILA, and ECOA controls are aligned with the CFPB's June 8, 2026 statement and the interagency guidance.
- Risk and finance functions may wish to evaluate whether allowance, concentration risk, and credit-loss assumptions need updating where exposure to this borrower segment is material.
What changed
The publication does not create a new lending ban or a new standalone rule. Instead, it restates that institutions should identify, measure, monitor, and control the credit risks associated with borrowers who are not legally authorized to work in the United States through underwriting practices that assess willingness and capacity to repay according to the credit terms.
The guidance specifically links this issue to the CFPB's June 8, 2026 Statement on Ability To Repay and Immigration Status and reminds creditors of obligations under the Truth in Lending Act as implemented by Regulation Z,...
Compliance impact
The agencies describe the issue as a credit-risk and safety-and-soundness matter, so the immediate impact is heightened supervisory scrutiny rather than a new prohibition. Institutions with meaningful exposure to affected borrowers may face criticism if underwriting, monitoring, and documentation do not clearly reflect the stated risks.