The same agencies telling banks to price deportation risk are eight days from narrowing the fair-lending rule that would normally police how they do it. And the borrowers being repriced have historically carried lighter debt loads than the new label implies.

_{Sources
1 OCC | Bulletin 2026-31, Interagency Guidance on Lending to Individuals Not Legally Authorized to Work in the United States
2 FDIC | FIL-36-2026, Interagency Guidance on Lending to Individuals Not Legally Authorized to Work in the United States
3 American Banker | Regulators Advise Banks to Weigh Immigration-Related Credit Risks
4 ABA Banking Journal | OCC, FDIC Release Guidance on Lending, Undocumented Workers
5 CNBC | Trump Administration Urges Banks to Scrutinize Lending to Immigrants Without Work Authorization
6 Federal Register | CFPB Statement on Ability To Repay and Immigration Status (Doc. 2026-11447)
7 Woods Rogers | What Lenders Should Know About Using Immigration and Citizenship Status Under ECOA in 2026
8 Urban Institute | ITIN Mortgages: Serving Creditworthy Borrowers Outside the Mainstream
9 Mortgage Professional America | Banks Told to Weigh Deportation Risk in Mortgage Decisions
10 Auto Finance News | 60-Plus-Day Subprime Auto DQs Hit 32-Year High
11 Wolf Street | Auto Loan Balances, Debt-to-Income Ratio, and Delinquencies of Subprime and Prime Auto Loans in Q1 2026
12 The Motley Fool | Subprime Auto Loans Just Hit Their Worst Delinquency Rate in 32 Years
13 Justia | Diana v. LVNV Funding LLC, No. A-52-24 (N.J. July 9, 2026)
14 Public Citizen Consumer Law and Policy Blog | NJ Supreme Court Holds No Private Right of Action to Void Loan Contract
15 Venable | State Commercial Financing Disclosure Laws: Where They Stand in 2026
16 Mortgage Professional America | Buy Now, Pay Later Could Be the Catalyst for the Next Credit Crisis, Private Lender Says
17 Federal Reserve | FEDS Note: Buy Now, Pay Later Beyond Pay in 4, a Comprehensive Product Overview
18 PYMNTS | FICO to Launch Credit Scores That Incorporate BNPL Data}

Read the procedural posture before reading the substance, because the posture is where credit committees overreact. The document is supervisory guidance issued by three agencies: the OCC under Comptroller Jonathan Gould, the FDIC, and the NCUA under Chairman Kyle Hauptman.³ It imposes no new legal requirements, carries no effective date, and opened no comment period. Its operative verb is "remind": institutions should "apply existing safe-and-sound credit risk management practices" to a borrower population the administration has directed the agencies to scrutinize under Executive Order 14406.^{1 2} The Federal Reserve's absence from the signature block is notable for a document styled as interagency, and none of the primary coverage explains it.⁴

Soft posture does not mean no consequence. Guidance is what examiners carry into the next cycle, and the practical directives here are specific: verify that employment income is current, stable, and likely to continue; treat loans to non-work-authorized borrowers as potentially higher risk regardless of current payment status; monitor concentration exposure tied to immigration enforcement changes; and weigh the difficulty of recovering collateral from a borrower who may be removed from the country.³ CNBC framed the intent bluntly: the administration wants banks to scrutinize this lending, and the agencies delivered the instruction in prudential language.⁵

The stated logic runs through the paycheck: a borrower whose work authorization is uncertain may lose income if an employer tightens compliance, or may be deported, so "the source of repayment" is less reliable.^{1 4} What the guidance does not supply is any standard for measuring that uncertainty: no probability framework, no look-back on how these loans actually perform, no threshold separating a prudent adjustment from an arbitrary one. That omission is part of the story, not a footnote. The agencies handed lenders a named risk factor without a yardstick, which means every institution will calibrate it alone and defend that calibration to two different audiences, the examiner and the fair-lending plaintiff, whose incentives point in opposite directions.

The available performance data cuts against the label. The Urban Institute found ITIN borrowers carry debt-to-income ratios around 25 percent, lower than comparable SSN borrowers, and already pay a rate premium of roughly half a point to two points; it counted only 5,000 to 6,000 ITIN mortgages originated in 2023 against latent demand it estimates at 73,000 to 88,000.⁸ Mortgage trade coverage of the guidance has already flagged the contraction risk: brokers who built ITIN programs on that performance record now face funding partners re-papering eligibility around a risk the data does not show.⁹

The through-line is Executive Order 14406, and the sequence is deliberate. June 5: a CFPB and FinCEN advisory put ITIN lending under anti-fraud surveillance. June 8: the CFPB's Statement on Ability To Repay and Immigration Status told creditors that TILA and Regulation Z may obligate them to consider immigration status where removal could disrupt income, and noted Regulation B permits considering it in evaluating repayment risk.⁶ June 20: the fraud flag citing roughly $2.5 billion in suspect filings, covered in our June 20 issue. July 13: the prudential agencies moved the question into classification and allowance.¹ In five weeks, immigration status went from a fair-access consideration to a quantifiable credit-risk input across every federal supervisory channel that touches lending. Each individual document disclaims new requirements. The sequence, read together, is the requirement.

For this desk, the sharpest fact in the file is jurisdictional: ECOA and Regulation B govern business credit, including MCA, factoring, equipment finance, and revenue-based financing, not just consumer loans.⁷ A large share of the SMB borrowers in these segments are immigrant-owned businesses whose principals hold ITINs. Counsel analyzing the 2026 landscape are consistent on the operational line: immigration status may be considered as one factor in repayment risk, but a blanket denial policy keyed to ITIN use or citizenship status invites disparate-treatment liability, and that theory survives untouched when the CFPB's revised Regulation B rule narrows disparate impact on July 21.⁷ The timing is the tension: the same month regulators tell lenders to scrutinize a protected-adjacent borrower class harder, the liability channel that historically disciplined over-broad screens gets smaller. What remains is the channel that catches written policy: a rule that says "no ITIN principals" is not a statistical artifact a lender can defend, it is a policy choice a plaintiff can quote.

Map the exposure before your funding partner asks. Count the principals in your book operating on ITINs or with known work-authorization uncertainty, by segment and by concentration. The guidance explicitly tells banks to monitor concentration risk, which means warehouse providers and forward-flow buyers will ask you for that number. The lender who produces it in a day looks governed; the one who needs a quarter looks like the risk.³

Underwrite the business, and document that you did. MCA, factoring, and RBF repayment runs through business receivables, not the principal's paycheck, which gives these products a structurally cleaner answer to the income-continuity theory than any consumer lender has. Put that logic in the credit file: repayment sourced to verified business cash flow, with the principal's status treated as one documented factor among several, individually assessed.

Kill any blanket ITIN screen now. If your decisioning contains a hard rule against ITIN principals, replace it with individualized assessment before July 21. The revised Regulation B narrows disparate impact, not disparate treatment, and a written exclusion rule is the cleanest disparate-treatment evidence a plaintiff or state attorney general could ask for.⁷

Watch the covenant channel, not the exam channel. Nonbank funders will feel this guidance through amended warehouse eligibility criteria, program covenants, and diligence questionnaires, not through examiners. When the first amendment arrives asking for work-authorization data on principals, negotiate for individualized-assessment language rather than categorical exclusions, because you, not the bank, will hold the ECOA exposure the exclusion creates.

Cobalt Intelligence's Contractor License Verification API searches by license number only. Not by name. Not by EIN. Not by entity. The API call is straightforward, the response is fast (30 to 60 seconds via async callback), and the data is live from the state portal. None of that matters if your application intake form never collected the license number from the contractor.

Most intake forms in construction lending collect the borrower's name and address, the EIN, and a credit pull authorization. Almost none collect the contractor's state license number itself. So the verification step downstream has nothing to work with. Underwriters end up on the state board's website, copying license numbers from screenshots or calling the applicant back, and the operational case for the API quietly disappears.

The fix is upstream of the API: a single required field at intake. Coverage today is California, Florida, New York, Texas, and Oregon. License status, expiration date, license type, and disciplinary actions return in one call. One credit per lookup. Live data, not a cached snapshot.

Build the intake form first.

Read more: Contractor License Verification API: Complete Guide for Construction Lenders

Reply "Yes" to this newsletter, and our Marketing Manager will contact you for instructions. Also, you may access it directly here and use the API Key from your account.

See Cobalt Business Verification Agent in action

Schedule a FREE demo call

Fitch Ratings' securitized auto ABS data put subprime 60-plus-day delinquencies at 6.90 percent in January 2026, a record in a series stretching back to January 1994 and above the Great Recession peak, easing only to 6.80 percent in February.¹⁰ The split is the story: prime 60-day delinquencies sit near 0.42 percent, total auto balances reached about $1.68 trillion in Q1, and the aggregate debt-to-income ratio actually fell to 7.17 percent. This is not broad consumer leverage failing; it is the bottom credit tier running out of cushion under 72-to-96-month terms and record negative equity.^{11 12} For a desk funding small businesses whose owners personally guarantee, subprime consumer stress is the leading indicator for the household standing behind the merchant account, and it lands weeks after Tricolor showed how fast subprime auto stress travels up the funding chain.

In a unanimous July 9 decision in Diana v. LVNV Funding, the New Jersey Supreme Court held the Consumer Finance Licensing Act contains no implied private right of action, affirming dismissal of a class action that sought to void debt purchases because the buyers were unlicensed.^{13 14} The Court leaned on legislative history, the 1997 predecessor statute deliberately removed an express private remedy, and held the statute's "void" language operates inside a penal framework enforced by the Banking Commissioner, not as a borrower's self-executing weapon.¹³ The ruling is consumer-statute specific, so commercial paper is touched only by analogy, but the allocation it reinforces, enforcement by regulators and attorneys general rather than private class actions, is the same pattern running through the ten state commercial-financing disclosure regimes now in force.¹⁵ Licensing diligence still matters; who gets to sue over it just changed in New Jersey.

Glen Weinberg of Fairview Commercial Lending argues credit files are "complete fiction" for BNPL-heavy borrowers, claiming a 750 score "really should have a 620" once invisible installment debt is counted; the crisis framing is his opinion and worth discounting.¹⁶ The anchor number checks out: a Federal Reserve FEDS Note published June 5 sized 2025 BNPL issuance at $156.7 billion, with Pay-in-4 at $78.3 billion, and most of that volume still does not feed the traditional scores lenders pull, because bureau furnishing by Affirm only began in 2025 and FICO's BNPL-inclusive scores are not yet widely adopted.^{17 18} For business-credit desks that lean on the owner's personal score, BNPL is consumer-side stacking: an unreported payment layer sitting ahead of your advance. The fix is the one this audience already knows, weight verified bank-statement cash flow over the bureau score, and read the statements for recurring Affirm, Klarna, and Afterpay debits.