FinCEN Issues Advisory on Employment of Non-Work Authorized Populations

On June 5, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), together with the Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, and National Credit Union Administration (collectively, the “Agencies”) issued an advisory  titled “Joint Advisory on Non-Work Authorized Populations and their Employers and Risks to the Integrity of the U.S. Financial System” (FIN-2026-A002, the “Advisory”). The Advisory urges financial institutions to be vigilant against risks presented by illicit activity involving the employment of non-work authorized populations.

Key Takeaways

• The Advisory focuses on identity theft and payroll fraud involving undocumented immigrants and their employers.
• Financial institutions should expect heightened regulatory scrutiny of the use of Individual Tax Identification Number (“ITIN”) and the Advisory encourages financial institutions to conduct enhanced due diligence on customers using an ITIN.
• FinCEN identifies 18 specific red flags to help financial institutions detect fraud.
• The Advisory establishes new concrete suspicious activity reporting (“SAR”) expectations for activities highlighted in the Advisory.

The Advisory arises from President Trump’s May 19, 2026, Executive Order (E.O.) 14406, Restoring Integrity to America’s Financial System, which directed the Secretary of the Treasury to issue an advisory to financial institutions to address risks associated with exploitation of the U.S. financial system by non-work authorized populations and their employers.

The Advisory Identifies Two Primary Fraud Typologies

The Advisory focuses on two interconnected categories of illicit activity:

Identity Theft. The Advisory notes that “complicit” employers knowingly accept fraudulent identification documents, and unlawful aliens illicitly obtain Social Security numbers (SSNs) and other personally identifiable information of U.S. citizens and lawful permanent residents in order to work in the United States. According to the Agencies, this information is used to pass Form I-9 verification, gain unlawful employment and wages, obtain healthcare benefits, and—based on FinCEN’s analysis of Bank Secrecy Act (“BSA”) reporting—fraudulently access financial services and credit products such as automobile loans. Victims of these identity theft schemes can face higher taxes and denial of healthcare, disability, and tuition benefits.

Payroll Fraud. According to the Agencies, complicit employers conceal Immigration Reform and Control Act (“IRCA”) violations by making off-the-books payments to undocumented workers, thereby evading payroll taxes. FinCEN has observed a significant amount of BSA reporting involving these schemes, with financial institutions reporting over $2.5 billion in suspicious activity associated with these schemes in 2025.

According to FinCEN, these schemes often involve complicit labor brokers who set up shell companies—frequently unregistered money services businesses (“MSBs”)—to provide off‑the-books payroll or payment processor services for complicit employers. Based on FinCEN’s analysis of BSA reporting, complicit labor brokers may also use the shell company to engage in other illicit transactions, such as money laundering for drug trafficking organizations and transnational criminal organizations.

Heightened Regulatory Scrutiny of ITIN Accounts

Under existing customer identification program (“CIP”) requirements, financial institutions are required to identify and verify each customer to the extent reasonable and practicable. For non-U.S. persons, one acceptable identifier has been a taxpayer identification number (e.g., ITIN). However, ITINs do not provide evidence of legal status in the United States, authorize recipients to work legally, or serve as identification outside of the Federal tax system. Consistent with the E.O., the Advisory states that the use of an ITIN in lieu of an SSN or valid employment authorization document may constitute a risk factor warranting enhanced due diligence at customer onboarding to ensure that the account is not being used to facilitate unlawful employment. Financial institutions are also encouraged to consider the use of an ITIN as a relevant risk factor, among others, in understanding the nature and purpose of customer relationships, developing customer risk profiles, and conducting ongoing transaction monitoring for suspicious activity.

The Agencies are further concerned by the use of an ITIN to obtain credit products or open depository accounts where the applicant lacks verified legal presence.

Importantly, the Advisory does not impose a blanket prohibition on ITIN-based accounts but signals that regulators will likely expect financial institutions to apply enhanced risk-based procedures when ITINs are used.

FinCEN Identifies 18 Red Flag Indicators

In addition to two cases studies, the Advisory identifies 18 risk indicators, or “red flags,” to help financial institutions detect, prevent, and report suspicious activity connected to fraud schemes involving the unlawful employment of undocumented workers. The Advisory includes categories of red flags for (i) customers, (ii) large companies and (iii) small companies in agriculture, construction, domestic service, hospitality, or staffing industries (Specified Industries). Among the most notable:

• An individual using an SSN that, upon verification, does not match or is inconsistent with SSA records.
• An individual opening an account using a non-U.S. passport or ITIN, claiming to be self-employed, or operating a small business in the Specified Industries, and receiving significant recurring check deposits followed by structured cash withdrawals or issuance of low-dollar checks to multiple individuals.
• A large company in the relevant industries with significant business operations but little to no payroll activity commensurate with the customer’s profile.
• A company making Federal and state payroll tax deposits that are significantly less than expected based on business operations and workforce size.
• A new customer (onboarded less than two years prior) with minimal or no online presence and indicators of being a shell company.

No single red flag is determinative. Financial institutions should consider the surrounding facts and circumstances—including historical financial activity, whether transactions align with prevailing business practices, and whether multiple red flags are present—before determining that a behavior or transaction is suspicious.

New SAR Filing Requirements and Reporting Expectations

In the Advisory, FinCEN requests that financial institutions filing SARs related to these activities include the key term “FINANCIALINTEGRITY-2026-A002” in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative. In addition, FinCEN encourages financial institutions and the public to report any tips or complaints about employers that knowingly  use unauthorized workers to ICE.

Practical Implications

The Advisory signals a meaningful escalation in regulatory expectations around the monitoring of unlawful employment-related financial activity. Financial institutions should consider the following practical steps:

1. Review and update BSA/AML risk assessments to incorporate the fraud typologies and red flags outlined in the Advisory, particularly for individual customers and companies operating in the Specified Industries.
2. Evaluate ITIN-related policies and procedures. While the Advisory does not prohibit the acceptance of ITINs as customer identifiers, it signals that regulators expect enhanced due diligence where an ITIN is presented in lieu of an SSN or valid employment authorization document—especially for credit products and depository accounts.
3. Calibrate transaction monitoring scenarios to identify structured and microstructured transactions, check-cashing patterns, and peer-to-peer payment flows consistent with off-the-books payroll activity and the other red flags identified in the Advisory.
4. Update SAR filing procedures to ensure the key term “FINANCIALINTEGRITY-2026-A002” is included in the appropriate fields when filing SARs related to the activity described in the Advisory.
5. Train front-line staff and compliance personnel on the red flag indicators in the Advisory and the broader fraud typologies, with particular attention to account‑opening scenarios involving non-U.S. passports, ITINs, and commercial mail receiving agency addresses that may indicate attempts to evade CIP requirements.