Trump EO Routes Immigration Enforcement Through the Bank Secrecy Act and CFPB Ability-to-Repay Rules

President Trump on May 19 signed an executive order titled "Restoring Integrity to America's Financial System," directing the Treasury Department, the Consumer Financial Protection Bureau, and the four federal banking regulators to write immigration status into the regulatory plumbing that governs how U.S. banks open accounts and extend credit.

The order does not itself prohibit banks from serving anyone. Instead it operates through two regulatory layers most consumers never see: the Bank Secrecy Act's customer identification and customer due diligence requirements, and the CFPB's ability-to-repay rules. Each carries its own deadline and its own implementing agency.

What the order requires Treasury to do

Section 3(a) directs the Secretary of the Treasury to issue, within 60 days, "a formal Advisory to financial institutions regarding the risks associated with the exploitation of the United States financial system by non-work authorized populations and their employers." The Advisory must enumerate red flags including payroll tax evasion patterns, foreign identity documents and shell companies, unregistered money services and peer-to-peer payment platforms, sub-threshold cash structuring, and labor trafficking indicators.

One red flag in the order is itself a policy claim. Section 3(a)(vi) names "the use of an individual taxpayer identification number (ITIN) to obtain credit products or open depository accounts where the applicant lacks verified lawful immigration status." The IRS describes the ITIN as a tax-administration number issued to people "not eligible for a Social Security number" and states that it does not "authorize you to work legally in the U.S." or "serve as identification outside the federal tax system." Many community banks, credit unions, and some larger institutions nonetheless accept ITINs as the taxpayer identification number under the Customer Identification Program rule at 31 CFR 1020.220. The order treats that practice as suspicious by default.

Section 3(b) gives Treasury 90 days to propose Bank Secrecy Act rule changes "strengthening customer due diligence." The operative language: institutions are to "maintain the authority, where warranted by other risk indicators or supervisory concerns, to obtain additional information necessary to resolve material compliance concerns, including information relevant to whether account holders possess lawful immigration status and employment authorization in the United States." Existing BSA customer due diligence rules — promulgated by FinCEN and enforced by the federal banking regulators — focus on beneficial ownership and the nature of customer relationships. The order grafts immigration and work-authorization status onto that framework.

Section 3(c) directs Treasury and the federal functional financial regulators — the Federal Reserve, the Office of the Comptroller of the Currency, the FDIC, and the National Credit Union Administration — to consider, within 180 days, rule changes that "account for the risks foreign consular identification cards pose to the integrity of the United States financial system." Cards such as Mexico's matrícula consular are currently accepted as primary or secondary identification by many U.S. banks under existing CIP guidance. The order does not ban them, but instructs the agencies to draft rules contemplating restrictions.

What the order requires CFPB and the regulators to do

Section 4(a) gives the Consumer Financial Protection Bureau 60 days to clarify that "potential deportation and loss of wages are factors that could adversely affect a non-work authorized borrower's ability to repay." The CFPB's existing ability-to-pay rule, Regulation Z §1026.51, requires card issuers to evaluate "the consumer's income or assets and the consumer's current obligations" and to have policies reflecting at least one of: the ratio of debt to income, debt to assets, or income remaining after debt service. Income, assets, and current obligations are quantitative inputs. "Potential deportation" is not. The order directs CFPB to write it into the framework anyway.

Section 4(b) directs each federal functional financial regulator to issue, within 60 days, "guidance regarding the management of the potential credit risks posed by the non-work authorized population." That guidance is the mechanism by which examiners will evaluate bank loan books and capital adequacy going forward.

The deadline stack

The order produces three near-term inflection points and one further out:

• ~July 18, 2026 (60 days): Treasury Advisory under §3(a); CFPB clarification under §4(a); regulator guidance under §4(b).
• ~August 17, 2026 (90 days): Treasury's proposed BSA rule changes under §3(b) enter the notice-and-comment process.
• ~November 15, 2026 (180 days): Treasury and the federal banking regulators consider rules on foreign consular ID cards under §3(c).

How this fits with other 2026 actions

The Bank Secrecy Act layer is one of three recent federal actions converging on the same population. The IRS in April issued proposed rules implementing the One, Big, Beautiful Bill Act's 1% remittance transfer excise tax — a levy that lands on cash, money orders, cashier's checks, and traveler's checks, the same instruments that ITIN-holder remittance flows commonly use. CMS guidance, separately, ends federal Medicaid matching funds for most non-citizens effective October 1. The May 19 order adds the banking layer.

Each operates through a different statute and a different agency. Together they produce a calendar in which tax, health-program, and banking obligations on the same population shift inside an eight-month window.

What is still to be written

The order itself is short. The substantive content arrives in three regulatory documents Treasury and CFPB have not yet drafted: the §3(a) Advisory, the §3(b) BSA proposed rule, and the §4(a) CFPB clarification. Wire will track each as it issues.