U.S. banking regulators have issued guidance urging banks to treat loans to undocumented immigrants as a potential source of heightened risk, according to The Wall Street Journal. The guidance does not bar such lending outright, but it directs institutions to factor immigration status into their risk assessments — a signal that will filter into underwriting models, fair-lending compliance frameworks, and CRA examination prep across the industry.

The move builds on groundwork laid earlier this year. On January 12, 2026, the government withdrew a policy that had explicitly prohibited lending discrimination against immigrants, as Reuters reported. That withdrawal removed an affirmative anti-discrimination backstop; the newer guidance goes further by actively steering banks toward caution on immigration status itself. Read together, the two actions trace a six-month arc from removing a protection to installing a supervisory nudge in the opposite direction.

For compliance and risk teams, the practical question is how "potentially risky" gets operationalized. Regulatory guidance of this kind typically shapes examiner expectations well before it shows up in any formal rule, and banks tend to over-comply to avoid safety-and-soundness criticism or consumer-compliance findings during exams. That dynamic — supervisory language driving behavior faster than statute or regulation — is familiar to anyone who has tracked how guidance documents move markets in mortgage servicing or BSA/AML enforcement. The Journal's reporting frames this as regulators under the current administration seeking to discourage the lending activity rather than prohibit it, which leaves banks to interpret the risk signal largely on their own.

That ambiguity is the crux of the story for an expert audience. Undocumented immigrants have historically accessed credit through ITIN-based mortgage programs, community development financial institutions, and some regional and community banks willing to underwrite outside standard agency guidelines. Fair lending law under ECOA and Regulation B does not treat immigration status as a protected class in the same way as race or national origin, but enforcement posture around adjacent proxies — national origin, language preference, documentation type — has long been a supervisory flashpoint. Withdrawing the explicit anti-discrimination policy in January removes a specific enforcement tool regulators previously could point to; the new guidance now gives banks an affirmative reason to pull back rather than merely permission to do so.

The sequencing matters for how banks will likely respond. A rule change requires notice-and-comment and creates a fixed compliance date. Guidance can be issued and rescinded with far less friction, and it carries less legal weight if challenged. That makes it a faster lever for regulators to pull, but also a less durable one — a point worth remembering given how quickly the January withdrawal was itself followed by this new directive. Institutions with meaningful ITIN lending books, or CDFIs and regional banks serving immigrant-heavy communities, face the most immediate decision: tighten underwriting now on a supervisory signal, or wait for something more binding.

There's also a portfolio-risk dimension examiners will be watching. If banks pull back on documented, previously performing loan books to undocumented borrowers, that could show up as reduced loan growth in specific geographic and demographic segments, potentially affecting CRA assessment area performance metrics for banks that have relied on such lending to meet community reinvestment obligations. The Journal's reporting does not specify enforcement mechanisms or a compliance timeline, so how examiners actually score this in the field remains an open question institutions will need to monitor through upcoming guidance updates or interagency statements.

None of this yet amounts to a change in the underlying law governing who can or cannot receive credit. What has changed is the supervisory signal bracketing that law — first by removing an explicit protection, then by adding an explicit caution. For risk and compliance functions, the near-term task is less about legal exposure and more about anticipating how examiners will read loan files during the next cycle.