Daily Weekly Podcast Blog API Regulator Agent Subscribe
occfdicncuacfpbcredit-riskecoacommunity-banks

Work Authorization Is Now a Credit-Risk Exam Item. The Word That Matters Is "Classification."

How the July 2026 OCC/FDIC/NCUA guidance and EO 14406 let examiners adversely classify current loans to non-work-authorized borrowers under ECOA.

By Lex, LexRegPulse Analyst · ·9 min read
Primary-source research · AI-drafted · human-reviewed. Methodology

By Lex

The press releases led with "elevated credit risk." That is the safe framing, and it is not where a chief compliance officer should be looking. The sentence that moves an examiner's leverage sits in the "Documentation and Verification" paragraph of the interagency guidance the OCC, FDIC, and NCUA issued on July 13: institutions "may consider whether loans to non-work authorized borrowers, individually or segments, exhibit signs of credit weakness regardless of delinquency status for classification purposes and treatment in the allowance for credit losses." Read it twice. A loan current on every payment can be adversely classified because of the borrower's work authorization — and once classified, it flows into the allowance and, downstream, into capital.

That is the operative shift, and it is why "this just reminds you of existing obligations" undersells what happened. On July 13, 2026, following the President's Executive Order on "Restoring Integrity to America's Financial System," the OCC, FDIC, and NCUA issued guidance reminding supervised institutions to apply existing safe-and-sound credit risk management practices when lending to borrowers not legally authorized to work in the United States. The guidance does not prohibit lending based on immigration status; it directs institutions to evaluate repayment risk through existing underwriting and risk-management practices. Nothing in it is a new rule. But it hands examiners a written, three-agency basis to ask why a segment defined by work authorization has not been separately identified, monitored, classified, and reserved against — while pointing the same institution at the Equal Credit Opportunity Act. That is the vise.

How we got here

The predicate is Executive Order 14406, "Restoring Integrity to America's Financial System," which the President signed on May 19, 2026. The order directed regulators to address risks to the financial system from extending credit to people who are inadmissible or removable under immigration law. It ran on two tracks: it told the CFPB to consider clarifying that deportation and loss of wages bear on a non-work authorized borrower's ability to repay, and it told each appropriate federal functional financial regulator to issue credit-risk guidance.

The CFPB went first. On June 8, 2026, the Bureau issued its "Statement on Ability To Repay and Immigration Status" to remind creditors of their Truth in Lending Act and Regulation Z obligations, consistent with Executive Order 14406. The move was not subtle. Creditors relying on income from U.S.-based employment are permitted — and may, under certain facts and circumstances, be obligated — to consider information bearing on the consumer's continuing ability to earn income, where U.S. residency is a necessary component of that employment. Consider the reversal: in January 2026 the CFPB withdrew the 2023 joint statement on considering immigration status under ECOA — the statement that had warned lenders off status entirely. In eighteen months the federal position went from "do not consider it" to "you may be obligated to consider it." A fair-lending program built to the 2023 posture is calibrated to the wrong end of the field.

One absence is louder than the coverage suggests. The order's own definition of "federal functional financial regulator" names the Federal Reserve alongside the OCC, FDIC, and NCUA. The July 13 guidance carries three names, not four. The Fed supervises state member banks and the holding companies atop much of the system, and it did not sign. The "each appropriate" qualifier gives it room to move separately, but a CRO at a state member bank should not read the Fed's silence as a safe harbor.

What it requires, and what it only permits

Look hard at the verbs. Institutions "should" apply sound underwriting that assesses capacity to repay — a restatement of the Interagency Guidelines Establishing Standards for Safety and Soundness, not a new command. The classification and documentation passages are softer: institutions "might consider" reviewing paystubs, W-2s, tax returns, and evidence of continuing work authorization, and "may consider" segment-level classification regardless of delinquency. Permissive language — but permissive supervisory language is how examiners acquire discretion. Once three agencies put "classification regardless of delinquency status" and "treatment in the allowance for credit losses" in a signed interagency document, an examiner who wants to press it has the citation.

The genuinely new operational demand is concentration analysis. The guidance warns that institutions with significant exposure to borrowers concentrated in geographic markets, employers, or industries disproportionately affected by changes in immigration enforcement, employment verification, labor availability, or workforce disruptions may face elevated concentration risk. That is a portfolio-level instruction most banks are not tooled for. Measuring it requires identifying the exposure — the very identification that creates the fair-lending problem.

The fair-lending line — and the trap most coverage missed

Start with what the law permits, because the guidance leans on it. Regulation B, which implements ECOA, expressly states that a creditor "may take the applicant's immigration status into account," and may consider that status and any additional information necessary to ascertain its rights and remedies regarding repayment. Considering status per se is not a Regulation B violation. The exposure lives one layer down: in blanket exclusions, in using status as a proxy for national origin, and in inconsistent application across similar applicants — disparate-treatment risk no executive order has touched.

Here is the part the wire coverage skipped, and it changes the calculus. The three agencies that issued this guidance are the same three that spent 2025 dismantling disparate-impact examination. The FDIC eliminated disparate impact from its Consumer Compliance Examination Manual in August 2025, following the OCC's July 2025 bulletin, and in September 2025 the NCUA stripped the doctrine from its Fair Lending Guide and instructed examiners to no longer request, review, or conclude on a credit union's disparate-impact risk. The trigger was Executive Order 14281, "Restoring Equality of Opportunity and Meritocracy," which set a federal policy of eliminating disparate-impact liability "in all contexts to the maximum degree possible." All three kept disparate treatment, HMDA analysis, and risk-based fair-lending exams in place.

Two things follow. The disparate-impact exam risk from the prudential regulators — an examiner citing a statistically disparate outcome from a neutral work-authorization screen — is, for now, largely gone; these examiners are not looking for it. But the doctrine did not die at the federal exam table alone. Note the moving target on Regulation B: the CFPB published a final rule in the Federal Register on April 22, 2026 removing the effects-test/disparate-impact framework from Regulation B, with an effective date on or about July 21, 2026 — and that rule is being challenged in litigation. Even if the rule survives, the Supreme Court's 2015 decision in Texas Department of Housing and Community Affairs v. Inclusive Communities Project still stands, and private plaintiffs, state attorneys general, and state civil-rights statutes still reach impact claims under their own authorities. The exposure did not disappear; it migrated from the examiner's workpapers to the plaintiffs' bar and the state AG. A bank that reads the 2025–2026 retreat as license to run a crude segment-level screen is trading a supervisory risk it no longer faces for a litigation risk it very much does.

The defensible middle path is narrow but real. Tie any consideration of work authorization to a documented, individualized income-continuity analysis — the reasoning Regulation Z already requires for expected income — not a categorical rule. Apply it consistently, paper the repayment rationale per decision, and manage the concentration exposure at the portfolio and allowance level rather than by purging identifiable borrowers. To be fair, some practitioners read the guidance as protective — confirmation that asking about work authorization in service of an ability-to-repay determination does not itself violate fair-lending law. They are not wrong on the narrow point. The error is treating permission to ask as license to exclude.

Is the CFPB saying something different? Not really.

There is less daylight between the Bureau and the prudential regulators than the two-track rollout implies, and the alignment is the story. The prudential agencies frame work authorization as a credit-risk factor for underwriting and allowance; the CFPB frames it as an ability-to-repay factor a creditor may be obligated to weigh. They reinforce each other. The caveat to log: the CFPB's statement says on its face that, as guidance, it does not have the force or effect of law and does not create new obligations. That hedge is litigation insulation for the Bureau, not comfort for a lender — the creditor still has to satisfy the underlying ATR rule, and "the guidance had no force of law" is no defense to a Regulation Z ability-to-repay finding.

What NCUA's signature means

NCUA's presence is not a formality. It extends every word of this to federally insured credit unions, including the minority depository institutions and community-development credit unions whose fields of membership are built around immigrant communities and whose ITIN-based lending is a deliberate growth strategy. Those institutions face the sharpest version of the tension: their mission is member access, the concentration paragraph describes their book by definition, and the guidance's logic pushes toward reserving against — or retreating from — the members they were chartered to serve. And NCUA has already told them the impact side of the fair-lending ledger is off the exam table.

The spillover the "integrity" framing ignores

The incentive runs one way. If banks and credit unions treat this segment as a classify-and-reserve problem, the rational response is to de-risk to the point of exit. The borrowers do not vanish; they move to nonbank and fintech lenders the OCC, FDIC, and NCUA do not supervise and this guidance does not reach. Those lenders remain subject to ECOA, and the larger ones to CFPB supervision, but they sit outside the prudential credit-risk framework that just tightened. So a policy titled "Restoring Integrity to America's Financial System" predictably pushes a borrower segment toward the least prudentially supervised corner of the market. For banks there is a CRA cost on top, because the affected borrowers cluster in the low- and moderate-income geographies where retreat shows up in a performance evaluation.

What to watch

Three things. Whether the Federal Reserve issues companion guidance or lets its silence stand — that governs exposure for state member banks and holding companies. The Treasury and FinCEN workstreams from the same order, which reach into BSA customer due diligence and identification programs and specifically flag ITINs and foreign consular identification cards; FinCEN issued a companion advisory, FIN-2026-A002, on June 5, 2026, jointly with the FDIC, OCC, and NCUA and in coordination with the IRS. And the litigation and state-enforcement channel, now the live venue for the impact theories the federal prudential agencies stopped examining — including the pending challenge to the CFPB's Regulation B rule. Congressional Democrats have already pressed the three agencies to restore disparate-impact review — a signal of where private and state plaintiffs will aim.

Bottom line

This is not a lending ban, and treating it as one is the mistake that creates real liability. It is a supervisory instruction to identify, classify, reserve against, and monitor a borrower segment defined by work authorization — from three agencies that, in the same eighteen months, took disparate impact off their own exam agenda. The defensible institution does the credit-risk work on an individualized, documented, consistently applied basis and keeps its fair-lending guard up where the exposure actually moved: private litigation and the states. The institution that reads "elevated credit risk" as cover for a categorical screen will pass its next safety-and-soundness exam and lose the case that follows.

Sources