Regulators issue guidance on detecting illicit payrolls

Processing Content

• Key insight: Regulators want banks to watch for Individual Taxpayer Identification Numbers, which they say can indicate someone is not authorized to work in the country. 
• Supporting data: Treasury’s Financial Crimes Enforcement Network said banks reported more than $2.5 billion in suspicious activity tied to payroll fraud schemes in 2025.
• Forward look: Banks will need to consider increasing due diligence and Suspicious Activity Report filing tied to suspected unauthorized employment.

Federal banking regulators and the Treasury Department’s Financial Crimes Enforcement Network on Friday warned banks to watch for signs of unauthorized employment schemes, payroll fraud and identity theft they say can facilitate tax evasion and transnational criminal activity.

The guidance, issued jointly by Fincen, the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency, and the National Credit Union Administration, in coordination with the Internal Revenue Service, argues that employers that hire undocumented immigrants gain an unfair advantage over law-abiding businesses and deprive federal and state governments of payroll taxes. 

The agencies also warned that access to the U.S. financial system by unauthorized workers and their employers can, in some cases, be leveraged to support transnational crime.

“Non-work authorized populations and their employers often rely on access to the U.S. financial system. In certain instances, the access to financial services and unlawfully obtained wages can be leveraged to facilitate the financing of transnational criminal organizations — several of which have been designated as Foreign Terrorist Organizations — and their global criminal enterprises, Including drug trafficking, human trafficking, and other illegal activity in the United States,” the advisory said. 

Guidance for banks has been anticipated as part of a May executive order entitled “Restoring Integrity to America’s Financial System.” The EO instructs the Treasury Department, bank regulators and the Consumer Financial Protection Bureau to issue these kinds of guidance to banks on “red flags” to identify the informal work arrangements upon which undocumented workers may rely. The agencies say the problem is widespread and that “financial institutions reported over $2.5 billion in suspicious activity associated with this type of scheme in 2025,” according to Fincen.

While the guidance says it does not create new obligations — repeatedly arguing the expectations in the advisory are rooted in existing customer identification and anti-money-laundering obligations — it encourages banks to take a hard look at activity connected to potentially unauthorized employment as well as the identity theft, payroll fraud, shell companies, and the use of Individual Taxpayer Identification Numbers, or ITINs, which are nine-digit numbers issued by the IRS often used by those who are required to file a return but are not eligible for a Social Security Number. Usage of ITINs, the guidance said, often accompanies such illicit employment arrangements. 

Fincen directs banks to file Suspicious Activity Reports as appropriate and encourages them to specifically tag activity related to the advisory by referencing the executive order in their filings, helping identify potentially suspicious immigration-status related employment activity.

The agencies do not direct banks to refuse accounts or credit products from customers using ITINs, but they encourage institutions to treat ITIN usage as a potential risk indicator that should trigger enhanced due diligence and customer risk assessment “as part of the bank’s application of appropriate risk-based procedures for customer due diligence.”

“The use of an ITIN in lieu of an SSN or valid employment authorization document may be identified as a risk factor requiring enhanced due diligence to ensure the account is not being utilized to facilitate the unlawful employment of unlawful aliens,” the advisory states. “Banks are further encouraged to conduct this assessment in light of the totality of other factors and information available to the bank to understand the nature and purpose of customer relationships for the purpose of developing customer risk profiles and conduct ongoing monitoring to identify and report suspicious transactions.”

The agencies also encourage banks to take additional verification steps when they suspect a Social Security number may be fraud-related, including using Social Security Administration verification tools.

“Where a financial institution has risk-based concerns about the authenticity of the SSN presented by a customer that prevent the institution from forming a reasonable belief that it knows the true identity of the customer, Fincen encourages financial institutions to verify the SSN to determine if it matches the Social Security Administration’s records,” the advisory said.

To illustrate the risks banks are expected to monitor, the advisory highlights identity theft schemes tied to illegal hiring. According to the agencies, unauthorized workers sometimes use Social Security numbers and personal information belonging to U.S. citizens and lawful residents to pass employment eligibility checks, earn wages and access credit.

The advisory also covers the risks tied to payroll fraud schemes involving “complicit” shell companies and labor brokers. Fincen describes a model in which third-parties create what look like legitimate businesses in industries such as construction, agriculture, hospitality and staffing to process illicit payroll and evade taxes.

“These schemes often start with complicit employers contracting with a complicit labor broker. The labor broker will set up a shell company either directly or through a nominee owner purporting to be involved in the agriculture, construction, domestic service, hospitality, or staffing industries,” the advisory states. “The shell company will often be an unregistered money services business providing off-the-books payroll or payment processor services for the complicit employers. According to the IRS, these shell companies may have generic names such as ABC Construction or XYZ Logistics that may correlate to the initials of the labor broker’s name.”