The borrowers now under a fraud microscope stay current on their loans at higher rates than citizens do. Every ITIN approval suddenly needs a documented rationale, and the wrong call exposes a lender to either an anti-money-laundering failure or a fair-lending complaint.

_{Sources
1 FinCEN | Advisory on Non-Work-Authorized Populations and ITIN-Based Account Due Diligence
2 American Banker | CFPB, FinCEN Guidance Casts a Pall Over ITIN Lending
3 Mayer Brown | FinCEN and Banking Agencies Issue Joint Advisory on ITIN-Based Account Due Diligence
4 NCRC | CFPB, FinCEN Guidance Casts a Pall Over ITIN Lending
5 Faegre Drinker | CFPB and FinCEN Highlight Compliance Considerations for Fintechs and Financial Services Providers
6 JD Supra | ITIN Lending Under New Regulatory Scrutiny (Regulation B Considerations)
7 Experian | The Financial Behavior and Creditworthiness of ITIN Holders
8 Financial Times | Thoma Bravo Hands Medallia to Lenders in One of Private Equity's Biggest Losses
9 PE Insights | Blackstone-Led Consortium Takes Control of Medallia
10 OnlyCFO | Thoma Bravo's $5B Medallia Loss
11 GreatAmerica | GreatAmerica Completes Acquisition of Heritage Bank and Launches GreatAmerica Bank
12 OCC | Conditional Approval #1357 (GreatAmerica / Heritage Bank)
13 Consumer Finance Insights | CFPB Issues New Rule on Use of AI Models in Mortgage Lending
14 Baker Donelson | CFPB's New Fair-Lending AVM Rule: No Surprises, But Big Changes}

Because of the list of industries the agencies chose to name. The advisory flags agriculture, construction, domestic service, hospitality, and staffing as the contexts of "particular concern" for ITIN-linked activity.¹ That is not an exotic corner of the economy. It is the core customer base of merchant cash advance, invoice factoring, equipment finance, and revenue-based financing. A restaurant funding a kitchen build, a framing crew financing a truck, a staffing agency advancing against receivables: these are the exact files the advisory now treats as elevated risk, and many of those businesses are owned or operated by ITIN holders.

The advisory is written for depository institutions, but the supervisory logic does not stop at the bank's edge. If a bank funds your warehouse line, sponsors your card or deposit rails, or buys your forward flow, its examiners will push the same due-diligence expectation down to the assets you originate. A nonbank that built an ITIN-friendly product as a differentiator is now a counterparty risk to its own funding bank, which means the pressure arrives whether or not a regulator ever knocks on your door.

It requires you to be able to show your work on every ITIN approval. The agencies stop short of mandating a specific procedure, but the practical standard is a documented, risk-based rationale for why a given ITIN applicant did not warrant the enhanced scrutiny the advisory says is presumptively warranted.³ Your default "approve" path for ITIN files, if it exists, is now the thing you have to justify.

The 18 red-flag indicators give the texture. They include SSN mismatches, ITINs or non-US passports presented in high-risk employment contexts, large or repetitive cash withdrawals and check cashing, payroll activity inconsistent with the customer profile, limited payroll-tax activity, shell-company characteristics, and the use of a commercial mail-receiving agency instead of a real business address.³ Several of those map directly onto signals a factoring or MCA shop already watches for other reasons, which is the one piece of good news here: the monitoring surface is familiar even if the regulatory weight on it is new.

It sits in the gap between two instructions that point in opposite directions. FinCEN's side of the advisory tells you to treat ITIN use as a fraud and illicit-finance signal and to investigate accordingly.¹ The consumer-protection side, anchored in ECOA and Regulation B and enforced by the CFPB, tells you that you cannot deny credit on the basis of noncitizen or immigration status and cannot let immigration-related information drive your decision in a prohibited way.⁵ Apply the fraud lens too hard and you build a disparate-impact case against yourself. Apply the fair-lending lens too hard and you fail the AML expectation.

The only defensible position in that gap is consistency you can prove. If ITIN files get a second look, every similarly situated file has to get the same second look, applied through written policy rather than the discretion of whoever happens to underwrite the deal.⁶ A pattern of higher decline rates on ITIN applicants without a documented, consistently applied rationale is exactly the evidence a fair-lending examiner or a plaintiff's lawyer would want. The advisory has effectively made "we treated everyone the same and can show it" the load-bearing sentence in your file.

Because an automated model cannot explain a decision it was never asked to explain. Many nonbank lenders route identity and thin-file applicants through scoring engines that accept an ITIN as one input among many and return an approve-decline-price answer in seconds. Under the new posture, that speed becomes a liability if the model cannot produce the risk-based rationale the advisory expects, or if it quietly weights ITIN presence in a way that creates a fair-lending problem the lender cannot see.³

This is also why this week's other regulatory story matters in the same breath. The CFPB's automated-valuation-model rule takes effect July 21 and pulls AI-driven credit infrastructure into explicit fair-lending and quality-control scope, a logic that examiners are signaling will not stay confined to mortgages.¹⁴ A lender carrying both exposures at once, an opaque model and an ITIN-heavy book, is holding two of the year's clearest examination risks in the same system.

Four things, in order. First, pull a sample of recent ITIN approvals and ask whether the file contains a written, consistent rationale, or just an automated approval and a funded deal. If it is the latter, you are building the record an examiner would use against you. Second, audit your decisioning model for whether immigration-related fields touch the output at all, because the cleanest way to survive a fair-lending review is to be able to show the model never weighted status in the first place.⁵

Third, fold the named red flags, remittance-heavy accounts with little other activity, commercial mail-receiving addresses, payroll-tax mismatches, into the monitoring you already run, so the AML side of the file is documented as a process rather than a judgment call.¹ Fourth, do not start demanding immigration documents. The advisory does not authorize it, ECOA exposure cuts against it, and it converts a financial-verification process into an immigration-status inquiry that is precisely what the consumer-protection side prohibits.² Verify financial identity and transaction patterns, not legal presence.

It is whether your engineers should own 51 government systems forever.

For lenders, this matters because verification infrastructure touches underwriting speed, audit evidence, and roadmap capacity.

If SOS verification is not the product you sell, maintenance should not consume senior engineering time.

Schedule a FREE demo call

Thoma Bravo's 2021 take-private of software maker Medallia, struck at roughly $6.4 billion of enterprise value at the top of the cycle, has ended with the sponsor writing off close to $5 billion of equity and a private-credit group led by Blackstone, with Apollo and KKR involved, taking control through a debt-to-equity conversion.⁸ The lenders injected about $150 million of fresh capital to cut leverage after the company's debt climbed from roughly $1.8 billion at acquisition toward an estimated $2.8 billion, and an attempted amend-and-extend in late 2025 reportedly failed, pushing the structure to a control reset rather than a maturity fix.⁹ The operator signal is that "sponsor-backed" is not a safety rating: when the equity cushion vaporizes, lenders inherit the company, and a borrower whose survival depends on serial refinancing should be underwritten as a restructuring candidate, not a growth credit.¹⁰

GreatAmerica Holdings completed its acquisition of Heritage Bank of Marion, Iowa on June 15 and launched GreatAmerica Bank, National Association, becoming a bank holding company and joining the small group of independent equipment-finance companies operating under a national charter.¹¹ The OCC cleared the deal in Conditional Approval #1357, letting the new bank retain and operate Heritage's existing branches, and GreatAmerica described the move as the end of a multi-year effort to add charter-based funding to a platform that already runs one of the largest independent commercial equipment-finance books in the country.¹² The operator signal is that the funding model is becoming a competitive weapon: a chartered rival can price off deposits and hold paper longer than a nonbank dependent on warehouse lines and securitization, which raises the bar for every independent lender still funding the same equipment assets on wholesale leverage.

The interagency rule governing automated valuation models, written by the CFPB with the Federal Reserve, FDIC, NCUA, OCC, and FHFA, takes effect July 21, 2026, and requires firms using AVMs in covered credit decisions to maintain quality-control standards for accuracy, guard against data manipulation and conflicts of interest, run random sample testing, and comply with nondiscrimination law.¹³ The rule is mortgage-focused on its face, but it formalizes the principle that an AI model touching credit is regulated infrastructure that must be explainable and tested, a logic regulators are signaling will not stay confined to home loans.¹⁴ The operator signal is that equipment lenders running automated asset-valuation or condition-scoring models, and any lender using a vendor score that shapes approvals or pricing, should treat July as the start of an explainability standard they will eventually be asked to meet, not a mortgage-only headline.