FinCEN, FDIC, OCC, and NCUA issue joint advisory on unlawful employment of noncitizens

On June 5, 2026, the US Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN), jointly with the Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), and National Credit Union Administration (NCUA) (together, the Agencies), issued an advisory (Advisory) in coordination with the Internal Revenue Service (IRS) alerting financial institutions (FIs) to suspicious and criminal activity connected to the unlawful employment of noncitizens in the US. Treasury published the Advisory pursuant to Executive Order (EO) 14406, issued May 19, 2026, which, among other things, directed Treasury to release a formal advisory regarding the “risks associated with the exploitation of the US financial system by non-work authorized populations and their employers.”*

Overview of the Advisory: Fraud typologies and red flags

The Advisory provides guidance on fraudulent schemes and criminal activity tied to the employment of non-work authorized individuals in violation of the Immigration Reform and Control Act of 1986 (IRCA). It identifies two fraud typologies affecting FIs – identity theft and payroll fraud used to conceal IRCA violations – and sets out 18 red flags to help FIs avoid unknowingly facilitating the transfer of wages obtained through these schemes.

Identity theft: Using stolen information to secure unlawful employment

Under this typology, non-work authorized individuals and employers in industries such as agriculture, construction, domestic service, and hospitality (Complicit Employers) obtain fraudulent identification documents, including social security cards, driver’s licenses, and permanent resident cards, bearing the illicitly obtained personally identifiable information (PII) of US citizens or lawful permanent residents. With these documents, a non-work authorized individual can submit a facially valid Form I-9 and thereby secure employment, wages, healthcare benefits, and loans. The fraudulently obtained PII may also be used to remit the resulting wages through FIs to the individual’s home country.

Payroll fraud: Concealing unlawful employment

Complicit Employers may also conceal IRCA violations by paying non-work authorized workers off the books, using cash or other irregular payment methods, while submitting fraudulent filings to the IRS. According to the Advisory, a common variation involves a labor broker who sets up a shell company to receive payments from a Complicit Employer, ostensibly for services or products related to the employer’s business. After deducting a portion of the funds as “payroll services,” the broker then funnels the money to non-work authorized individuals through cash couriers, checks, or peer-to-peer platforms – all while withholding no taxes and structuring transactions to stay below the Bank Secrecy Act’s reporting and recordkeeping thresholds.

Red flags: Indicators for detecting, preventing, and reporting activity connected to fraud schemes

Building on prior guidance from an August 15, 2023, notice on payroll tax evasion, the Agencies identified 18 red flags associated with unlawful employment-related fraud schemes and organized around three customer categories: (1) individual customers; (2) large corporate customers in the agricultural, construction, domestic service, hospitality, or staffing industries (Relevant Industries); and (3) small corporate customers in the Relevant Industries. Notable indicators include:

• Individual customers that:
  • Use social security numbers (SSNs) inconsistent with Social Security Administration (SSA) records.
  • Open accounts using a non-US passport or an Individual Taxpayer Identification Number (ITIN) claiming to be self-employed or operating small businesses in the Relevant Industries and receiving large amounts and volumes of recurring check deposits from multiple companies before making a significant and repetitive amount of structured cash withdrawals or issuing low-dollar checks to multiple people.
  • Have no prior involvement in the Relevant Industries and provide a non-US passport or ITIN as identification when opening an account for a new company in the Relevant Industries.
• Large corporate customers operating in the Relevant Industries that:
  • Have a history of worksite compliance violations from Immigration and Customs Enforcement.
  • Have significant business operations/transactional activity but little to no payroll activity commensurate to the customer’s profile.
  • Issue significant and repetitive amounts of checks to a small number of companies with little online presence.
• Small corporate customers operating in the Relevant Industries that:
  • Have beneficial owners with fraud convictions or no prior connections to the customer or Relevant Industries.
  • Issue recurring, large volumes of checks under $1,000 made payable to large numbers of individuals who cash the checks.

No single red flag is determinative on its own; FIs should weigh the surrounding facts and circumstances before concluding that an activity or transaction is suspicious or otherwise threatens the integrity of the US financial system. Where a suspicious activity report (SAR) relates to the conduct described in the Advisory, FIs should include the key term “FINANCIALINTEGRITY-2026-A002” in SAR field 2 and the narrative.

Enhanced due diligence considerations for ITINs and SSNs

Because ITINs may be issued to resident and nonresident noncitizens and do not establish work authorization or legal status, the Agencies recommend that banks factor ITIN use into their risk-based customer due diligence (CDD) procedures. Specifically, banks are encouraged to consider whether a customer’s use of an ITIN, rather than an SSN or a valid employment authorization document, to obtain credit products or open an account is a relevant risk factor. Where an SSN is presented but its authenticity is in doubt, banks are encouraged to compare it against SSA records.

Fraud enforcement as a FinCEN national priority

The Advisory reflects the federal government’s broader emphasis on combatting fraud. In a July 21, 2026, statement before the US House of Representatives Committee on Financial Services’ Subcommittee on National Security, Illicit Finance, and International Financial Institutions, then-FinCEN Director Andrea Gacki reaffirmed fraud enforcement as a FinCEN priority and described the agency’s ongoing work identifying typologies associated with various fraud schemes. The Advisory fits within this broader effort, aligning with FinCEN’s Anti-Money Laundering and Countering the Financing of Terrorism National Priorities, which name combatting fraud as a national priority.

Key compliance takeaways for financial institutions

Together, EO 14406 and the Advisory signal heightened government scrutiny of how FIs may be used to facilitate unlawful immigration and related fraud. FIs should review and update their policies and procedures in light of the typologies and red flags described in the Advisory and should be alert for potential regulatory changes to CDD and customer identification program (CIP) requirements pursuant to EO 14406.

*Note: This client alert does not address the mandates contained in EO 14406 to (1) FinCEN to amend the Bank Secrecy Act’s CDD and CIP requirements or (2) the Consumer Financial Protection Bureau to consider clarifying whether potential deportation and loss of wages are factors relevant to a non-work authorized borrower’s ability to repay a loan, or whether lenders may weigh such factors in underwriting determinations. FinCEN has not yet engaged in regulatory action regarding the CDD and CIP mandate.