Lending to Non-Work-Authorized Borrowers: A 2026 Control Map

TL;DR

• On July 13, 2026, the OCC, FDIC, and NCUA issued guidance about lending to individuals not legally authorized to work in the United States. Use that exact term rather than a broader immigration label.
• The guidance describes a potential credit-risk issue and points institutions to existing practices. It does not create a categorical lending ban or prescribe a universal underwriting factor, verification method, portfolio segment, or allowance adjustment.
• Regulation B permits consideration of immigration status for a defined purpose while separately prohibiting national-origin discrimination. Policy, model, exception, and adverse-action controls need to preserve that distinction.

The July 2026 guidance creates a difficult control-design problem, but not the one suggested by a blunt “lend or do not lend” policy.

The OCC’s Bulletin 2026-31 says lending to people who are not legally authorized to work in the United States may involve elevated credit risk because income generation, employment continuity, and financial stability may be uncertain. It tells supervised institutions to continue assessing source of repayment, repayment capacity, financial condition, resources, and willingness to repay. It also says uncertainty about employment authorization may affect income stability, repayment capacity, collateral recovery, or other relevant risk factors.

The verb matters: may. Work-authorization status is not a substitute for a borrower-level repayment analysis, and the guidance does not say every borrower in the described population presents the same risk.

What is guidance, and what is an independent legal duty?

The OCC, FDIC, and NCUA described their July 13 document as guidance reminding supervised institutions of existing credit-risk obligations. The NCUA’s joint-agency release says institutions should identify, measure, monitor, and control the risk through safe-and-sound underwriting. The OCC bulletin says institutions are expected to incorporate relevant risk into:

• underwriting;
• account management;
• credit classification;
• allowance analysis; and
• compliance processes.

That list is not a license to invent a mandatory control. The sources do not prescribe continuous work-authorization monitoring, a separate loan grade, a dedicated portfolio flag, a fixed pricing premium, an automatic qualitative allowance adjustment, or a blanket decline rule. Any of those choices would require a product-specific rationale, legal review, operational feasibility assessment, and testing.

Separate statutes and regulations still govern the credit transaction. Two current Regulation B provisions are central:

• 12 CFR 1002.6(b)(7) permits a creditor to consider immigration or permanent-resident status and information needed to ascertain the creditor’s rights and remedies regarding repayment.
• The same section, at paragraph (b)(9), prohibits a creditor from considering national origin in any aspect of a credit transaction, except as otherwise permitted or required by law.

Do not collapse those provisions into “Regulation B allows work-authorization screening.” The regulation refers to immigration status and a particular rights-and-remedies purpose. The interagency guidance discusses the related but different question of whether employment-authorization uncertainty affects a concrete credit risk. Counsel should define what information the institution may collect, why it is needed, and how it may affect a decision for each product and jurisdiction.

A control map that stays inside the source

Start with the actual risk pathway, not a borrower label.

This table is an implementation aid, not an agency checklist. The defensible result may differ by mortgage, auto, credit card, small-business, or secured-lending product because the income horizon, collateral, repayment source, data, and governing rules differ.

Four guardrails for policy and model changes

1. Define the credit mechanism

A policy should identify the relevant credit fact—such as probable continuance of income, source of repayment, collateral recovery, or legal rights and remedies—and explain how it affects the product. Avoid categorical statements about a population when the guidance itself says risk may be elevated.

The mechanism must also be observable and operational. If the institution cannot reliably collect or validate a proposed input, an informal guess by an underwriter is not a control. It is an inconsistency generator.

2. Keep national origin out of the decision path

Country of birth, surname, language, neighborhood, accent, and similar characteristics should not become shortcuts for immigration or work-authorization status. Review data sources, derived variables, manual judgment, vendor models, and exception practices—not only policy wording.

The relevant question is not whether a model field is named “national origin.” It is whether the institution uses prohibited information directly or through a proxy, treats similarly situated applicants differently, or permits ungoverned discretion that produces inconsistent treatment. Statistical monitoring can help detect those problems, but the test design and legal conclusions should reflect the current law and the institution’s jurisdictions.

3. Preserve accurate adverse-action reasons

If a permitted credit factor contributes to a denial or other adverse action, the decision system must be able to produce the notice required by 12 CFR 1002.9. A vague label such as “immigration risk” may fail to describe the actual principal reason and may conceal inconsistent decision logic.

Validate that the reason surfaced to the applicant matches the factor that drove the outcome. This duty comes from ECOA and Regulation B; it is not newly created by the July guidance.

4. Do not automate an unsupported allowance conclusion

The guidance names allowance analysis, but it does not order a separate segment or a positive reserve adjustment. Accounting, Credit Risk, and Model Risk should determine whether existing data and methodology capture a relevant risk and document the result. A conclusion that no adjustment is supported can be as important as a documented change.

A status-based overlay with no performance evidence, risk mechanism, or accounting analysis would be hard to defend. So would an allowance memo that never considers a material, observed portfolio risk.

The 2026 Regulation B rule does not erase the core safeguards

The CFPB’s 2026 Regulation B final rule, effective July 21, 2026, states that ECOA does not authorize disparate-impact liability and changes the Bureau’s discouragement and special-purpose-credit-program provisions. Articles and controls written before that effective date should not present an ECOA disparate-impact theory as unchanged current Regulation B doctrine.

That change does not authorize intentional national-origin discrimination, remove paragraph 1002.6(b)(9), or eliminate adverse-action notice requirements. The final rule also notes that other statutes and state laws remain. A compliance review therefore needs an authority map: ECOA/Regulation B, TILA/Regulation Z where applicable, other federal law, state fair-lending law, and product-specific requirements.

Outcome testing can remain useful even where one legal theory has changed. Frame it accurately: a control for detecting inconsistent treatment, prohibited proxies, model defects, or risk under other law—not proof that the July interagency guidance imposed a new statistical-testing mandate.

A bounded implementation record

A practical change record can fit on one page per product:

1. Scope: supervised legal entity, product, borrower population, and guidance applicability.
2. Risk mechanism: the specific source-of-repayment, income-continuity, collateral, or rights-and-remedies issue identified.
3. Current coverage: policy, underwriting, model, classification, allowance, servicing, and compliance controls that already address it.
4. Legal constraints: permitted data and use, prohibited bases, notice duties, privacy, and relevant state law.
5. Decision: control change, no change, or further analysis—with evidence and approval.
6. Validation: sample testing, reason-code review, exception review, model or rules testing, and a date for reassessment.

Do not describe this as a regulator-required 30-day plan. It is a RiskTemplates recommendation for turning a short guidance document into an auditable decision without overstating what the agencies said.

The right response is not automatic tighter treatment. It is a precise record showing that Credit Risk identified the relevant risk, Compliance and Legal constrained the method, Finance assessed allowance implications, and the institution can explain each resulting credit decision without using national origin as a shortcut.

Primary sources

• OCC Bulletin 2026-31: Interagency Guidance on Lending to Individuals Not Legally Authorized to Work in the United States
• NCUA: Agencies Issue Guidance on Lending to Individuals Not Legally Authorized to Work in the United States
• 12 CFR 1002.6: Rules concerning evaluation of applications
• 12 CFR 1002.9: Notifications
• CFPB 2026 final rule: Equal Credit Opportunity Act (Regulation B)